{"id":"CVE-2026-115494","title":"CSRF protection could be tricked by forged X-Forwarded-Host header in KNIME Business Hub","summary":"A flaw in the cross-site request forgery (CSRF) prevention of KNIME Business Hub prior to version 1.19.0 allows an authenticated attacker to perform a CSRF attack with passive user interaction. This means the state of a resource could be…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/U:Green","cvssSource":"cna","cwe":["CWE-352"],"vendor":"KNIME","product":"KNIME Business Hub","affected":["business_hub < 1.19.0"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-22T18:33:34.845709Z"},"published":"2026-10-22","updated":"2026-10-22","sourceUpdated":"2026-10-22T19:00:31.097Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-115494","references":[{"url":"https://www.knime.com/security/advisories"}],"tags":["cve.org"],"ingestedAt":"2026-10-22T22:00:50.374Z","slug":"CVE-2026-115494","body":"## Overview\n\nA flaw in the cross-site request forgery (CSRF) prevention of KNIME Business Hub prior to version 1.19.0 allows an authenticated attacker to perform a CSRF attack with passive user interaction. This means the state of a resource could be changed without the user noticing. As a workaround, an API gateway for firewall in front of KNIME Business Hub could remove the X-Forwaded-For header from all incoming requests.\n\n## Affected\n\n- `business_hub < 1.19.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}