# CVE-2026-115519: Sensitive cookies without 'Secure' and 'HttpOnly' attributes in KNIME Business Hub

Status: published. Published: 2026-10-22. Updated: 2026-11-02.

Missing security attributes on sensitive cookies in KNIME Business Hub before version 1.19.0 allow an unauthenticated remote attacker to compromise user sessions if other security issues such as a cross-site scripting vulnerability or a man-in-the-middle attack are present. A workaround is not possible.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- KNIME / KNIME Business Hub: ≥ 0; < 1.19.0 (affected, semver); 1.19.0 (unaffected, semver). Source: CNA: KNIME

## Severity and prioritization

- CVSS 4.0: 2.1 (low); CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N; source: CNA: KNIME

- CISA KEV: No listing in collected sources

- EPSS: 0.19% as of 2026-11-01; percentile 8.25%

- SSVC: exploitation none; automatable no; technical impact partial; source ADP: CISA-ADP

- Weaknesses: CWE-614, CWE-1004

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://www.knime.com/security/advisories (CNA: KNIME)

## Provenance

- CNA: KNIME: https://www.cve.org/CVERecord?id=CVE-2026-115519; retrieved 2026-11-02; source updated 2026-11-02

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-115519; retrieved 2026-11-02; source updated Not reported

Revision: cf5bfbcfef70755323adfc882e22eda7763b66e5a5b41653041eca66150f6b89

Canonical: https://y2.dev/cve/CVE-2026-115519