PT-2026-27354 · Knime+1 · Knime Business Hub+1

Published 2026-03-24 · Updated 2026-03-24 · CVE-2026-4649

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:M/U:Amber

Name of the Vulnerable Software and Affected Versions Apache Artemis versions prior to 2.52.0 KNIME Business Hub (affected versions not specified)

Description An authentication bypass flaw exists in Apache Artemis, potentially allowing unauthorized access to messages exchanged through the broker and the injection of new messages. This issue impacts KNIME Business Hub as it utilizes Apache Artemis. Exploitation requires at least normal user privileges and the ability to execute workflows within an executor. An attacker with these privileges can register a federated mirror without authentication, enabling them to read internal messages and inject new ones.

Recommendations Update Apache Artemis to version 2.52.0 or later. Update KNIME Business Hub to version 1.18.0, 1.17.4, or 1.16.3.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-4649

Affected Products

Apache Artemis

Knime Business Hub

References · 6

• https://ubuntu.com/security/CVE-2026-4649 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-4649 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-4649 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-4649 · Vendor Advisory
• https://knime.com/security/advisories#CVE-2026-4649 · Note
• https://twitter.com/VulmonFeeds/status/2036434264317632984 · Twitter Post