{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-06-02T18:45:01.512","vulnerabilities":[{"cve":{"id":"CVE-2026-4649","sourceIdentifier":"security@knime.com","published":"2026-03-24T09:16:39.763","lastModified":"2026-03-24T15:53:48.067","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Apache Artemis before version 2.52.0 is affected by an authentication bypass flaw which allows reading all messages exchanged via the broker and injection of new message ( CVE-2026-27446 https://www.cve.org/CVERecord ). Since KNIME Business Hub uses Apache Artemis it is also affected by the issue. However, since Apache Artemis is not exposed to the outside it requires at least normal user privileges and the ability to execute workflows in an executor. Such a user can install and register a federated mirror without authentication to the original Apache Artemis instance and thereby read all internal messages and inject new messages.\n\nThe issue affects all versions of KNIME Business Hub. A fixed version of Apache Artemis is shipped with versions 1.18.0, 1.17.4, and 1.16.3.\n\nWe recommend updating to a fixed version as soon as possible since no workaround is known."},{"lang":"es","value":"Apache Artemis anterior a la versión 2.52.0 está afectado por una falla de omisión de autenticación que permite leer todos los mensajes intercambiados a través del bróker e inyección de nuevos mensajes ( CVE-2026-27446 https://www.cve.org/CVERecord ). Dado que KNIME Business Hub utiliza Apache Artemis, también está afectado por el problema. Sin embargo, dado que Apache Artemis no está expuesto al exterior, requiere al menos privilegios de usuario normal y la capacidad de ejecutar flujos de trabajo en un ejecutor. Dicho usuario puede instalar y registrar un espejo federado sin autenticación a la instancia original de Apache Artemis y así leer todos los mensajes internos e inyectar nuevos mensajes.\n\nEl problema afecta a todas las versiones de KNIME Business Hub. Una versión corregida de Apache Artemis se envía con las versiones 1.18.0, 1.17.4 y 1.16.3.\n\nRecomendamos actualizar a una versión corregida lo antes posible, ya que no se conoce ninguna solución alternativa."}],"metrics":{"cvssMetricV40":[{"source":"security@knime.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:M/U:Amber","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"YES","Recovery":"USER","valueDensity":"CONCENTRATED","vulnerabilityResponseEffort":"MODERATE","providerUrgency":"AMBER"}}]},"weaknesses":[{"source":"security@knime.com","type":"Secondary","description":[{"lang":"en","value":"CWE-306"}]}],"references":[{"url":"https://www.knime.com/security/advisories#CVE-2026-4649","source":"security@knime.com"}]}}]}