---
id: "CVE-2026-115519"
kind: "vulnerability"
aliases: ["CVE-2026-115519"]
title: "KNIME Business Hub: session cookies missing security flags, enabling session compromise"
severity: "low"
cvss: 2.1
epss: 0.00186
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["knime", "other", "self-hosted"]
not_affected_if: ["version-1.19.0-or-later"]
published_at: "2026-10-22T19:17:48+00:00"
first_seen_at: "2026-10-23T21:57:31+00:00"
updated_at: "2026-10-25T04:50:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115519", "first_seen_at": "2026-10-23T21:57:31+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-115519", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# KNIME Business Hub: session cookies missing security flags, enabling session compromise

KNIME Business Hub before 1.19.0 sets sensitive cookies without their security attributes. An unauthenticated remote attacker can compromise user sessions only when another flaw such as XSS or a man-in-the-middle position is also present.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed KNIME Business Hub version against `1.19.0`
- Unknown whether the sources give a cookie-inspection command or setting

## Fix

- Upgrade KNIME Business Hub to `1.19.0` or later
- No workaround is available per the sources

## Timeline

- 2026-10-23T21:57:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115519
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-115519

## From the sources

Missing security attributes on sensitive cookies in KNIME Business Hub before version 1.19.0 allow an unauthenticated remote attacker to compromise user sessions if other security issues such as a cross-site scripting vulnerability or a man-in-the-middle attack are present. A workaround is not possible.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_