Live › vulnerability › CVE-2026-115494
Go to dashboardKNIME Business Hub before 1.19.0 has a flaw in its cross-site request forgery prevention. An authenticated attacker can get a logged-in user's browser to change resource state without the user noticing.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running KNIME Business Hub before version 1.19.0 are exposed, especially where users stay logged in while browsing other sites. The sources do not describe further configuration conditions. Teams on 1.19.0 or later are not affected.
No product ranges from the sources yet.
1.19.01.19.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw in the cross-site request forgery (CSRF) prevention of KNIME Business Hub prior to version 1.19.0 allows an authenticated attacker to perform a CSRF attack with passive user interaction. This means the state of a resource could be changed without the user noticing. As a workaround, an API gateway for firewall in front of KNIME Business Hub could remove the X-Forwaded-For header from all incoming requests.
This page as .md · .json · in your agent: get_signal("CVE-2026-115494")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.