{"id":"CVE-2026-115494","kind":"vulnerability","aliases":["CVE-2026-115494"],"related":[],"title":"KNIME Business Hub: CSRF protection flaw lets attackers change resources silently","description":"A flaw in the cross-site request forgery (CSRF) prevention of KNIME Business Hub prior to version 1.19.0 allows an authenticated attacker to perform a CSRF attack with passive user interaction. This means the state of a resource could be changed without the user noticing. As a workaround, an API gateway for firewall in front of KNIME Business Hub could remove the X-Forwaded-For header from all incoming requests.","summary":"KNIME Business Hub before 1.19.0 has a flaw in its cross-site request forgery prevention. An authenticated attacker can get a logged-in user's browser to change resource state without the user noticing.","severity":"medium","cvss":5.3,"epss":0.00191,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["knime-business-hub","other","self-hosted"],"not_affected_if":["version-1.19.0-or-later"],"how_to_check":"- Check the installed KNIME Business Hub version and compare it with `1.19.0`\n- unknown","fix":"- Upgrade KNIME Business Hub to `1.19.0` or later\n- As a workaround, strip the X-Forwarded-For header from all incoming requests at an API gateway or firewall in front of KNIME Business Hub","status":"open","published_at":"2026-10-22T16:17:35+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-25T04:19:06+00:00","updated_at":"2026-10-25T04:19:06+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T04:19:06Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade KNIME Business Hub to `1.19.0` or later\n- As a workaround, strip the X-Forwarded-For header from all incoming requests at an API gateway or firewall in front of KNIME Business Hub","reach":"internet","title":"KNIME Business Hub: CSRF protection flaw lets attackers change resources silently","impact":"medium","summary":"KNIME Business Hub before 1.19.0 has a flaw in its cross-site request forgery prevention. An authenticated attacker can get a logged-in user's browser to change resource state without the user noticing.","category":"other","nicknames":[],"who_cares":["knime-business-hub","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Resource state changed by forged requests from a logged-in user's browser","analyst_note":"","how_to_check":"- Check the installed KNIME Business Hub version and compare it with `1.19.0`\n- unknown","needs_analyst":false,"not_affected_if":["version-1.19.0-or-later"],"who_is_affected":"Teams running KNIME Business Hub before version 1.19.0 are exposed, especially where users stay logged in while browsing other sites. The sources do not describe further configuration conditions. Teams on 1.19.0 or later are not affected.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000586,"input_tokens":3408,"output_tokens":491,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115494':14A,17A '-2026':13A,16A '1.19.0':30B,80C 'allow':81C 'api':112C 'attack':8A,44B,84C,89C 'authent':43B,83C 'browser':53B 'busi':2A,20B,27B,75C,120C 'chang':9A,55B,103C 'could':101C,122C 'cross':37B,67C 'cross-sit':36B,66C 'csrf':4A,71C,88C 'cve':12A,15A 'firewal':115C 'flaw':6A,33B,63C 'forgeri':40B,70C 'forwad':127C 'front':117C 'gateway':113C 'get':46B 'header':129C 'host':25B 'hub':3A,21B,28B,76C,121C 'incom':132C 'interact':93C 'knime':1A,19B,26B,74C,119C 'knime-business-hub':18B 'let':7A 'log':49B 'logged-in':48B 'mean':95C 'notic':61B,107C 'passiv':91C 'perform':86C 'prevent':41B,72C 'prior':77C 'protect':5A 'remov':123C 'request':39B,69C,133C 'resourc':10A,56B,100C 'self':24B 'self-host':23B 'silent':11A 'site':38B,68C 'state':57B,97C 'user':51B,60B,92C,106C 'version':79C 'without':58B,104C 'workaround':110C 'x':126C 'x-forwaded-for':125C","nicknames":[],"mitigations":[],"who_affected":"Teams running KNIME Business Hub before version 1.19.0 are exposed, especially where users stay logged in while browsing other sites. The sources do not describe further configuration conditions. Teams on 1.19.0 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T16:17:35+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Green","cvss_by":"security@knime.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115494","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115494","severity":null,"published_at":"2026-10-22T16:17:35+00:00","modified_at":"2026-10-22T19:17:48+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115494","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115494","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}