Live › vulnerability › CVE-2026-115519
Go to dashboardKNIME Business Hub before 1.19.0 sets sensitive cookies without their security attributes. An unauthenticated remote attacker can compromise user sessions only when another flaw such as XSS or a man-in-the-middle position is also present.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running KNIME Business Hub before . The exposure depends on a second weakness such as XSS or a man-in-the-middle position on the connection, so the risk is lower on hardened networks with TLS everywhere. Teams on or later are not affected.
1.19.01.19.0No product ranges from the sources yet.
1.19.01.19.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing security attributes on sensitive cookies in KNIME Business Hub before version 1.19.0 allow an unauthenticated remote attacker to compromise user sessions if other security issues such as a cross-site scripting vulnerability or a man-in-the-middle attack are present. A workaround is not possible.
This page as .md · .json · in your agent: get_signal("CVE-2026-115519")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.