Vulnerability Description
A flaw in the cross-site request forgery (CSRF) prevention of KNIME Business Hub prior to version 1.19.0 allows an authenticated attacker to perform a CSRF attack with passive user interaction. This means the state of a resource could be changed without the user noticing. As a workaround, an API gateway for firewall in front of KNIME Business Hub could remove the X-Forwaded-For header from all incoming requests.
Related Weaknesses (CWE)
References
FAQ
What is CVE-2026-115494?
CVE-2026-115494 is a documented vulnerability. A flaw in the cross-site request forgery (CSRF) prevention of KNIME Business Hub prior to version 1.19.0 allows an authenticated attacker to perform a CSRF attack with passive user interaction. This m...
How severe is CVE-2026-115494?
CVSS scoring is not yet available for CVE-2026-115494. Check NVD for updates.
Is there a patch for CVE-2026-115494?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.