CVE-2026-115494 PUBLISHED

CSRF protection could be tricked by forged X-Forwarded-Host header in KNIME Business Hub

Assigner: KNIME
Reserved: 22.10.2026 Published: 22.10.2026 Updated: 22.10.2026

A flaw in the cross-site request forgery (CSRF) prevention of KNIME Business Hub prior to version 1.19.0 allows an authenticated attacker to perform a CSRF attack with passive user interaction. This means the state of a resource could be changed without the user noticing. As a workaround, an API gateway for firewall in front of KNIME Business Hub could remove the X-Forwaded-For header from all incoming requests.

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/U:Green
CVSS Score: 5.3

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	None	Confidentiality	None
Attack Complexity	Low	Integrity	Low	Integrity	None
Attack Requirements	None	Availability	None	Availability	None
Privileges Required	None
User Interaction	Passive

CVSS 4.0

Product Status

Vendor	KNIME
Product	KNIME Business Hub
Versions	Default: unaffected affected from 0 to 1.19.0 (excl.) Version 1.19.0 is unaffected

References

https://www.knime.com/security/advisories

Problem Types

CWE-352 Cross-Site request forgery (CSRF) CWE

Impacts

CAPEC-62 Cross Site Request Forgery