CVE-2026-115519EUVD-2026-108279GHSA-P7R5-WMFJ-6X3R
Sensitive cookies without 'Secure' and 'HttpOnly' attributes in KNIME Business Hub
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 1.19.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
KNIME Business Hub, an older release line of this data science platform, is affected by missing security flags on its sensitive session cookies. If other weaknesses such as cross-site scripting or a man-in-the-middle attack are also present, an unauthenticated remote attacker could hijack user sessions.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Missing security attributes on sensitive cookies in KNIME Business Hub before version 1.19.0 allow an unauthenticated remote attacker to compromise user sessions if other security issues such as a cross-site scripting vulnerability or a man-in-the-middle attack are present. A workaround is not possible.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- KNIME KNIME Business Hub
fixed in 1.19.0