KNIME Business Hub CVE-2026-115494

Exploitation requires a victim with an active, authenticated KNIME Business Hub session (prior to 1.19.0) to be induced into passive interaction with attacker-controlled content (UI:P), at which point the browser submits a forged state-changing request that the Hub's CSRF prevention fails to reject. The vendor ties the weakness to handling of the X-Forwarded-For header - the documented workaround is to place an API gateway/firewall in front of the Hub that strips X-Forwarded-For from all incoming requests. Limiting factors: the target user must be logged in and must be lured into triggering the request; impact is restricted to low-integrity resource-state changes with no confidentiality or availability effect; and deployments already behind a gateway that removes X-Forwarded-For are protected. The only complete fix stated by the vendor is upgrading to 1.19.0 or later.

This is a medium-severity CSRF flaw (CWE-352) with a vendor-supplied CVSS 4.0 base score of 5.3, and the real-world signals point to a low-to-moderate, non-urgent priority rather than a critical one. The 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) indicates network reach, low complexity, no attacker privileges, and passive user interaction, but impact is confined to low integrity only (VI:L) with no confidentiality or availability impact (VC:N/VA:N) and no scope change (SC:N/SI:N/SA:N) - consistent with a resource-state change rather than code execution or data theft. No EPSS score, CISA KEV listing, or exploit/PoC reference is present in the input, so there is no evidence of active or likely imminent exploitation. The vuln.today decision label is 'this_month,' aligning with routine patching rather than emergency action. One notable tension: the description characterizes the attacker as 'an authenticated attacker,' whereas the CVSS 4.0 vector sets PR:N (no attacker privileges) - in CSRF this typically reflects that the victim must be authenticated while the attacker needs no account, but the wording is ambiguous and should be verified with the KNIME advisory before relying on an authentication assumption.

An attacker lures a user who holds an active authenticated KNIME Business Hub session into viewing attacker-controlled web content, which silently causes the user's browser to submit a forged, state-changing request to the Hub. Because CSRF prevention can be bypassed (the vendor's workaround centers on stripping the X-Forwarded-For header), the request is accepted and a resource's state is changed without the user noticing. No public exploit identified at time of analysis; exploitation requires passive user interaction (UI:P) but low complexity otherwise.