Read the docs
TI-2026-79494 Aliases CVE-2026-115519GHSA-p7r5-wmfj-6x3r

Missing Secure and HttpOnly flags on cookies in KNIME Business Hub

Priority LOW 10CWE-1004Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

KNIME Business Hub before version 1.19.0 sets sensitive cookies without the Secure and HttpOnly attributes. An unauthenticated remote attacker can compromise user sessions when other security issues, such as a cross-site scripting vulnerability or a man-in-the-middle attack, are present. No workaround is available.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

Description from the CNA

Missing security attributes on sensitive cookies in KNIME Business Hub before version 1.19.0 allow an unauthenticated remote attacker to compromise user sessions if other security issues such as a cross-site scripting vulnerability or a man-in-the-middle attack are present. A workaround is not possible.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00186 8th percentileScored 2026-11-07
Fix Fixed KNIME Business Hub (KNIME): 1.19.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
KNIMEKNIME Business Hubbefore 1.19.01.19.0Patch availableCNA
  • KNIME Business Hub VendorKNIME Affected before 1.19.0 Fixed in 1.19.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:knime:business_hub:*:*:*:*:*:*:*:*——KNIME
  • cpe:2.3:a:knime:business_hub:*:*:*:*:*:*:*:* Versions — — ·KNIME

Remediation

Update KNIME Business Hub to version 1.19.0, which fixes this issue. No workaround is available.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

  • Fix · CNA KNIME Business Hub (KNIME) Fixed in 1.19.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    KNIME Business Hub 1.19.0

    5 records Highest priority Priority LOW 5 LOW

    Other records, highest priority first

    • TI-2026-79493 Missing isolation between execution contexts in KNIME Business HubPriority LOW 29
    • TI-2026-79324 Missing authorization in KNIME Business Hub DataApp links exposes jobsPriority LOW 28
    • TI-2026-79307 Large tables in data apps can bring down execution services in KNIME HubPriority LOW 24
    Show all 5 records →

Timeline

  1. 2026-10-22 Threatist record created from CVE-2026-115519
  2. 2026-10-22 Alias added: GHSA-p7r5-wmfj-6x3r
  3. 2026-11-02 CISA SSVC decision points changed

References

Other 1

  • TI-2026-79492 Incorrect authorization exposes accounts in KNIME Business Hub SaaS CVSS 4.0MEDIUM 6.9
  • TI-2025-02116 Hard-coded password for object store of KNIME Business Hub CVSS 4.0HIGH 8.8
  • TI-2025-02436 Ingress-nginx vulnerability in KNIME Business Hub CVSS 4.0HIGH 8.7
  • TI-2021-20243 KNIME Server before 4.13.4 allows XSS via the old WebPortal login page. CVSS 3.1HIGH 8.8
  • TI-2026-79312 Error messages leak workflow names to users in KNIME Business Hub CVSS 4.0MEDIUM 6.9
  • TI-2022-22037 Uploading workflows to KNIME Server may override arbitrary file system contents CVSS 3.1HIGH 7.5
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences