CVE-2025-2402

CVE-2025-2402 describes a critical vulnerability in KNIME Business Hub, affecting all versions except 1.13.2+, 1.12.3+, 1.11.3+, and 1.10.3+. This flaw stems from a hard-coded, non-random password for the MinIO object store. An unauthenticated remote attacker can exploit this to read and manipulate sensitive data, including swapped jobs and active job inputs/outputs, or cause a denial-of-service by overwhelming the object store. The vulnerability carries a CVSS score of 8.6 (HIGH), indicating a severe risk due to its network-based attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. There are no viable workarounds, necessitating an immediate update to a patched version. Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage are minimal, which is typical for the majority of CVEs.