Cross-Site Request Forgery Vulnerability in KNIME Business Hub by KNIME
CVE-2026-115494

5.3MEDIUM

Key Information:

Vendor

Knime

Status
Knime Business Hub
Vendor
CVE Published:
22 October 2026

What is CVE-2026-115494?

A flaw in the cross-site request forgery (CSRF) prevention mechanism in KNIME Business Hub prior to version 1.19.0 enables authenticated attackers to execute CSRF attacks with minimal user interaction. This vulnerability poses a risk of altering resource states without the user's awareness. To mitigate this risk, deploying an API gateway with appropriate firewall settings, which strips the X-Forwarded-For header from incoming requests, is recommended. For more detailed information, refer to the security advisories provided by KNIME.

Affected Version(s)

KNIME Business Hub 0 < 1.19.0

KNIME Business Hub 1.19.0

References

https://www.knime.com/security/advisories

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.