CVE-2026-115494mediumCWE-352

CVE-2026-115494: falha de média gravidade em KNIME Business Hub

CSRF protection could be tricked by forged X-Forwarded-Host header in KNIME Business Hub

Publicada em

Seguir esta CVE+ Monitorar KNIME Business Hub

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.2%
A flaw in the cross-site request forgery (CSRF) prevention of KNIME Business Hub prior to version 1.19.0 allows an authenticated attacker to perform a CSRF attack with passive user interaction. This means the state of a resource could be changed without the user noticing. As a workaround, an API gateway for firewall in front of KNIME Business Hub could remove the X-Forwaded-For header from all incoming requests.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/U:Green
Produtos afetados
KNIME · KNIME Business Hub
CVEs relacionadas — KNIME Business Hub

No mesmo produto, das mais perigosas para as menos.

CVE-2023-2541MEDIUMSensitive information disclosure in KNIME Hub Web ApplicationEPSS 0.6%CVE-2024-6598HIGHDenial-of-service on KNIME Business Hub when certain jobs are executedEPSS 0.5%CVE-2025-2787HIGHIngress-nginx vulnerability in KNIME Business HubEPSS 0.5%CVE-2026-115517MEDIUMUnrestricted network access between execution contexts in KNIME Business HubEPSS 0.4%CVE-2023-3140MEDIUMKNIME Hub Web Application is vulnerable to clickjackingEPSS 0.4%CVE-2026-115496MEDIUMWorkflow names may be leaked to unauthenticated users in KNIME Business HubEPSS 0.4%