Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-115494

CSRF protection could be tricked by forged X-Forwarded-Host header in KNIME Business Hub

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
KNIME

Description

A flaw in the cross-site request forgery (CSRF) prevention of KNIME Business Hub prior to version 1.19.0 allows an authenticated attacker to perform a CSRF attack with passive user interaction. This means the state of a resource could be changed without the user noticing. As a workaround, an API gateway for firewall in front of KNIME Business Hub could remove the X-Forwaded-For header from all incoming requests.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

KNIME KNIME Business Hub

Default version status: unaffected

  • 0 to < 1.19.0affected
  • 1.19.0unaffected

References