CVE-2026-115494: KNIME Business Hub CSRF Vulnerability

CVE-2026-115494 Overview

CVE-2026-115494 is a Cross-Site Request Forgery (CSRF) vulnerability in KNIME Business Hub versions prior to 1.19.0. The flaw affects the application's CSRF prevention mechanism and allows an authenticated attacker to trigger state-changing requests through passive user interaction. Victims may not notice resource state changes performed on their behalf. The issue is tracked under CWE-352 and was published to the NVD on October 22, 2026.

Critical Impact
An authenticated user visiting a malicious page can be coerced into submitting unintended state-changing requests to KNIME Business Hub, modifying resources without visible indication.

Affected Products

KNIME Business Hub versions prior to 1.19.0

Discovery Timeline

2026-10-22 - CVE-2026-115494 published to NVD
2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-115494

Vulnerability Analysis

The vulnerability stems from a weakness in the CSRF prevention logic of KNIME Business Hub. CSRF protections typically bind requests to a session via tokens or origin checks. In affected versions, those checks can be circumvented when an attacker crafts a request that an authenticated user's browser transmits automatically.

Because the exploitation path requires passive user interaction, the attacker needs the victim to visit an attacker-controlled page or follow a crafted link. The victim's active session with KNIME Business Hub supplies the authentication context. The server processes the forged request as legitimate and applies the resource state change.

The advisory indicates the X-Forwarded-For header plays a role in the attack path, suggesting the CSRF defense may rely on client-identifying information that an upstream proxy can be made to pass through. Removing or sanitizing this header at the perimeter mitigates the exposure.

Root Cause

The root cause is improper enforcement of CSRF defenses on authenticated state-changing endpoints [CWE-352]. The validation logic does not sufficiently distinguish between requests originating from the legitimate web interface and those forged by third-party origins.

Attack Vector

Exploitation occurs over the network and requires an authenticated victim. The attacker hosts malicious content that triggers an HTTP request to KNIME Business Hub. The victim's browser attaches session cookies, and the server executes the forged action. No exploit code or public proof-of-concept is listed in the advisory.

See the KNIME Security Advisory for technical details.

Detection Methods for CVE-2026-115494

Indicators of Compromise

Unexpected changes to KNIME Business Hub resources (workflows, spaces, users) with no corresponding user-initiated session activity.
HTTP requests to state-changing KNIME endpoints with Referer or Origin headers pointing to unrelated external domains.
Requests containing anomalous X-Forwarded-For values that do not match known upstream proxy addresses.

Detection Strategies

Review KNIME Business Hub access logs for POST, PUT, PATCH, and DELETE requests whose Origin or Referer headers do not match trusted hosts.
Correlate resource-modification events with user interface navigation telemetry to identify actions that lack a preceding UI interaction.
Alert on inbound requests where the X-Forwarded-For header is present but originates from a client bypassing the sanctioned API gateway.

Monitoring Recommendations

Enable verbose audit logging for all resource-mutation endpoints in KNIME Business Hub and forward logs to a centralized SIEM.
Monitor web proxy and gateway telemetry for outbound navigation from internal users to newly observed external domains during active KNIME sessions.
Baseline normal administrative activity and alert on deviations in resource change frequency per authenticated user.

How to Mitigate CVE-2026-115494

Immediate Actions Required

Upgrade KNIME Business Hub to version 1.19.0 or later as the authoritative fix.
Instruct administrators to log out of KNIME Business Hub when not actively using the console to reduce the window of exploitation.
Review recent audit logs for unauthorized state changes on sensitive resources.

Patch Information

KNIME has addressed the issue in KNIME Business Hub 1.19.0. Consult the KNIME Security Advisory for release notes and upgrade instructions.

Workarounds

Place an API gateway or firewall in front of KNIME Business Hub and strip the X-Forwarded-For header from all incoming requests, as recommended in the vendor advisory.
Restrict access to KNIME Business Hub to trusted networks or VPN-connected clients to limit CSRF reach from arbitrary web origins.
Enforce browser-level protections such as SameSite=Strict cookies on reverse proxies where feasible, pending upgrade.

bash

# Example NGINX configuration to strip X-Forwarded-For before proxying to KNIME Business Hub
location / {
    proxy_set_header X-Forwarded-For "";
    proxy_set_header Host $host;
    proxy_pass http://knime-business-hub-backend;
}