# CVE-2026-115494: KNIME Business Hub CSRF protection bypass via forged header

Source: https://junglewise.ai/threats/cve-2026-115494-a-flaw-in-the-cross-site-request-forgery-csrf-prevention-of  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-22. Updated: 2026-10-22  
License: CC BY 4.0 with a link back

CVE-2026-115494 · Severity: info · Published 2026-10-22

KNIME Business Hub is a web-based data analytics and workflow management platform. A flaw in its CSRF protection allows an authenticated attacker to trick the security check using a forged X-Forwarded-Host header, enabling them to perform unwanted state-changing actions on behalf of a logged-in user without the user's knowledge.

Technologies: [Knime Business Hub](https://junglewise.ai/threats/technologies/business-hub). Vendors: [Knime](https://junglewise.ai/threats/vendors/knime).

## Quick answers

**Is CVE-2026-115494 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-115494 being exploited in the wild.

**How severe is CVE-2026-115494?** Informational severity, published 22 October 2026.

**Which products and versions are affected?** Knime Business Hub prior to 1.19.0.

**Is there a fix for CVE-2026-115494?** Yes: fixed in KNIME Business Hub 1.19.0. Until then: Deploy an API gateway or firewall in front of KNIME Business Hub to remove the X-Forwarded-For header from all incoming requests. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-115494 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-115494?** Check whether you run Knime Business Hub at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in KNIME Business Hub 1.19.0

Deploy an API gateway or firewall in front of KNIME Business Hub to remove the X-Forwarded-For header from all incoming requests.

## Technical details

The CSRF prevention mechanism in KNIME Business Hub prior to 1.19.0 can be bypassed by forging the X-Forwarded-Host header, allowing an attacker to perform unauthorized actions. The vulnerability requires authentication and user interaction (passive, such as visiting a malicious page while logged in). An attacker can modify resource state without explicit user consent.

## Affected products

- KNIME Business Hub prior to 1.19.0

## Timeline

- 2026-10-22: disclosed

## References

- [https://www.knime.com/security/advisories](https://www.knime.com/security/advisories)

## Related threats

- [KNIME Business Hub missing security attributes on sensitive cookies](https://junglewise.ai/threats/cve-2026-115519-missing-security-attributes-on-sensitive-cookies-in-knime)
- [KNIME Business Hub unrestricted network access between execution contexts](https://junglewise.ai/threats/cve-2026-115517-unrestricted-network-access-between-execution-contexts-in-knime)
- [KNIME Business Hub SaaS incorrect authorization in account information](https://junglewise.ai/threats/cve-2026-115516-an-incorrect-authorization-issue-exposes-basic-account)
- [KNIME Business Hub missing authorization check in DataApp links](https://junglewise.ai/threats/cve-2026-115502-a-missing-authorization-check-allows-anyone-having-access-to-a)
- [KNIME Business Hub information disclosure in catalog](https://junglewise.ai/threats/cve-2026-115496-overly-informative-error-messages-in-the-catalog-functionality)