KNIME Analytics Platform erroneously records proxy credentials in log files when an executor operates under KNIME Server or KNIME Business Hub for long‑term supported releases older than 5.8.4. The logged username/password can be read by any user with file‑system access to the logs, allowing an attacker to impersonate the configured proxy user and potentially bypass authentication on targeted resources. The weakness is a cleartext credential storage flaw, sufficient to compromise confidentiality of proxy credentials.

The vulnerability affects the KNIME Analytics Platform LTS distribution used as an executor within KNIME Server or KNIME Business Hub. Versions earlier than 5.8.4 (including the 5.12.0 line) are susceptible. The issue was addressed in LTS releases 5.8.4 and 5.12.0 and later.

The CVSS score of 4.8 classifies it as moderate severity. EPSS data is not available, and the vulnerability is not listed in CISA KEV, implying no publicly confirmed exploits. An attacker would need access to the system’s log files—typically a local or compromised‑remote file‑system read privilege—to extract the credentials. The vulnerability does not enable remote code execution or denial of service and therefore its exploitation likelihood depends largely on existing file‑permission controls around log storage.