Low severity · published Oct 22, 2026
CVE-2026-115519
Sensitive cookies without 'Secure' and 'HttpOnly' attributes in KNIME Business Hub
New
2.1
CVSS
0.2%
EPSS
No
On KEV
Description
Missing security attributes on sensitive cookies in KNIME Business Hub before version 1.19.0 allow an unauthenticated remote attacker to compromise user sessions if other security issues such as a cross-site scripting vulnerability or a man-in-the-middle attack are present. A workaround is not possible.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KB
KNIME Business Hub · KNIME
before 1.19.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-115519
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-115519
www.knime.com
https://www.knime.com/security/advisories
More from KNIME Business Hub
7.2
CVE-2025-11240
Open redirect vulnerability in KNIME Business Hub
6.9
CVE-2026-115496
Workflow names may be leaked to unauthenticated users in KNIME Business Hub
6.4
CVE-2026-115517
Unrestricted network access between execution contexts in KNIME Business Hub
6.3
CVE-2026-115502
DataApp links without login expose job information to other user in KNIME Business Hub
5.3
CVE-2026-115494
CSRF protection could be tricked by forged X-Forwarded-Host header in KNIME Business Hub