An excessive resource allocation flaw in the remote workflow editing functions of KNIME Business Hub allows an authenticated user to exhaust server resources, causing the workflow execution service to become intermittently unavailable. This denial of service arises from the creation or handling of large tables in data apps, leading the server to consume excessive memory or processing time. The impact remains confined to the execution side of the Hub but can affect all users relying on that service.

KNIME Business Hub versions earlier than 1.19.0, particularly the remote workflow editing feature.

The weakness is rated with a CVSS score of 5.3, indicating moderate severity. EPSS data is not available, so the exact likelihood of exploitation is uncertain, and the vulnerability is not listed in the CISA KEV catalog. The attack vector requires authenticated access to the Hub's workflow editor; no public or anonymous exploitation path is documented. In a scenario where privileged users can create or edit workflows, an attacker could trigger repeated large table operations to deplete server resources, resulting in a temporary denial of service for all workflow execution requests.