Vulnerability · Published Oct 22, 2026 · Assigned by KNIME

CVE-2026-115494CSRF protection could be tricked by forged X-Forwarded-Host header in KNIME Business Hub

Medium 5.3

In plain English

A medium-severity cross-site request forgery in KNIME Business Hub from KNIME. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 4.0)5.3Medium

Exploit odds (30 days)0.2%top 91.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A flaw in the cross-site request forgery (CSRF) prevention of KNIME Business Hub prior to version 1.19.0 allows an authenticated attacker to perform a CSRF attack with passive user interaction. This means the state of a resource could be changed without the user noticing. As a workaround, an API gateway for firewall in front of KNIME Business Hub could remove the X-Forwaded-For header from all incoming requests.

Affected products (as reported)

Vendor	Product	Versions
KNIME	KNIME Business Hub	0 – before 1.19.0

Weakness: CWE-352 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/U:Green

References

https://www.knime.com/security/advisories