CVE-2026-115519

Sensitive cookies without 'Secure' and 'HttpOnly' attributes in KNIME Business Hub

State: Published
Severity: 2.1 Low
Published: Oct 22, 2026
Updated: Oct 22, 2026
Reserved: Oct 22, 2026

Description

Missing security attributes on sensitive cookies in KNIME Business Hub before version 1.19.0 allow an unauthenticated remote attacker to compromise user sessions if other security issues such as a cross-site scripting vulnerability or a man-in-the-middle attack are present. A workaround is not possible.

Scores

CVSS	Score	Vector	Source
4.0	2.1 Low	CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N	KNIME

Weaknesses

CWE-614 Sensitive cookie in HTTPS session without 'secure' attribute
CWE-1004 Sensitive cookie without 'HttpOnly' flag

Affected Products

Product	Versions
KNIME Business HubKNIME	before 1.19.0Affected 1.19.0Not affected

References

https://www.knime.com/security/advisories

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.