KNIME Business Hub EUVD-2026-108279

Exploitation is strictly chained and cannot occur in isolation: a separate exploitable cross-site scripting vulnerability must exist in KNIME Business Hub, OR the attacker must hold a man-in-the-middle position on the network path, in order to read or intercept the session cookie that is missing its protective attributes (CWE-614 - e.g. Secure/HttpOnly/SameSite). This dependency is the dominant limiting factor and is encoded as AT:P (Attack Requirements: Present) in the CVSS 4.0 vector. The flaw affects KNIME Business Hub before version 1.19.0; the vendor states a workaround is not possible, so upgrading to 1.19.0 is the only remediation.

This is a low-priority, defense-in-depth issue rather than a standalone threat. The vendor-assigned CVSS 4.0 base score is 2.1 (Low), and the vuln.today decision label is 'monitor' - both consistent with a non-urgent finding. CWE-614 (missing security attributes on sensitive cookies) is not directly exploitable: the description itself states compromise is only possible 'if other security issues such as a cross-site scripting vulnerability or a man-in-the-middle attack are present,' which the CVSS 4.0 Attack Requirements metric correctly reflects as AT:P. No KEV listing, no EPSS score, and no proof-of-concept were provided; the sole reference is the KNIME vendor advisory, so there is no public exploit identified at time of analysis. CONFLICT TO VERIFY: the description calls the actor an 'unauthenticated remote attacker,' yet the supplied CVSS vector sets PR:H (high privileges required) - these are inconsistent and should be reconciled with the vendor. Net: a real but minor hardening gap whose exploitability is entirely gated on a separate, more serious vulnerability existing in the same environment.

In an environment where a KNIME Business Hub instance (before 1.19.0) also has an exploitable XSS flaw, or where an attacker already holds a man-in-the-middle position on the network path, the attacker leverages the missing cookie security attributes to read or replay a victim's session cookie and hijack their authenticated session. The flaw cannot be triggered on its own and no public exploit code was provided for this specific issue.