CVE-2026-115519: Sensitive cookies without 'Secure' and 'HttpOnly' attributes in KNIME Business Hub
Published Oct 22, 2026
·Updated
Missing security attributes on sensitive cookies in KNIME Business Hub before version 1.19.0 allow an unauthenticated remote attacker to compromise user sessions if other security issues such as a cross-site scripting vulnerability or a man-in-the-middle attack are present. A workaround is not possible.
Affected Software
1 affected component
KNIME Business Hub<1.19.0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
KNIME Business Hubto a version that resolves this vulnerability.Fixed in 1.19.0
Event History
Oct 22, 2026
CVE Published
via MITRE·06:18 PM
Data Sourced
via MITRE·06:18 PM
DescriptionWeakness