CVE-2026-115494: CSRF protection could be tricked by forged X-Forwarded-Host header in KNIME Business Hub
A flaw in the cross-site request forgery (CSRF) prevention of KNIME Business Hub prior to version 1.19.0 allows an authenticated attacker to perform a CSRF attack with passive user interaction. This means the state of a resource could be changed without the user noticing. As a workaround, an API gateway for firewall in front of KNIME Business Hub could remove the X-Forwaded-For header from all incoming requests.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
KNIME Business Hubto a version that resolves this vulnerability.Fixed in 1.19.0 - Compensating control
Place an API gateway or firewall in front of KNIME Business Hub and remove the X-Forwaded-For header from all incoming requests.
Event History
Frequently Asked Questions
Which deployments are affected?
KNIME Business Hub versions prior to 1.19.0 are affected. The issue concerns deployments that accept attacker-controlled forwarded headers, specifically the header referenced in the workaround.
What does an attacker need to exploit this issue?
An attacker must already be authenticated and must be able to induce passive user interaction. Successful exploitation can change the state of a resource without the user noticing.
What can be done if upgrading is not immediately possible?
Place an API gateway or firewall in front of KNIME Business Hub and remove the X-Forwaded-For header from all incoming requests.