Hi,

Our Network Security team has recommended adding the following security headers to our Qlik Sense environment:

X-Frame-Options: Sameorigin/deny
X-XSS-Protection : 1; mode=block
X-Content-Type-Options : nosniff
Content-Security-Policy : script-src 'self'
X-Permitted-Cross-Domain-Policies
Referrer-Policy : no-referrer
Cross-Origin-Opener-Policy: same-origin
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Cache-Control:
no-store, max-age=0
Pragma: no-cache

Has anyone implemented these headers in Qlik Sense Enterprise on Windows? I’d appreciate guidance on:

• Which headers are compatible with Qlik Sense, and whether any could affect the Hub, mashups, or extensions.
• Where each header should be configured, including whether any require a different approach.
• How to test the changes safely before applying them in production.

Thanks in advance!

Regards,

Tushar C.

Hi Qlik Community, 

¡IMPORTANT!

If you are on QAP and leverage anonymous authentication, do NOT upgrade to May 2026 Initial Release.

We have upgraded one of our TEST environments and noticed this issue:

even if the Virtual Proxy is configured to Allow Anonymous Users, they are being prompted for authentication.

So, please check your virtual proxy configuration before upgrading, or wait for the fix.

The Virtual proxies that are configured as Always anonymous users are working as expected.

@Giuseppe_Novello | @Sonja_Bauernfeind | @Ray_Strother 

@Eduardo_Monteiro | @SergioProba | @kauenascimento | @AnaSilva 

Has anyone found a way to generate an AI-based description for a Qlik Dataset or Data product? We have recently been toying around with some of the built AI meta data generation features in Qlik and have found them very useful and acceptably accurate. We could of course go into each of the Datasets or Data products and manually generate the descriptions.

However, we think it would be easier to have the generation automated and have someone review the results. It would be great be able to automate this along with the Quality Computation.

From https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497

Node.js shipped a security update on Wednesday for a flaw in how it decompresses Brotli data, a bug people are already calling Node2Shell (CVE-2026-111497). If an attacker can get a malicious payload in front of your app, the flaw can crash the process, leak part of its memory, or potentially let them run their own code.

Who is affected: anyone running Node.js or Bun whose app decompresses Brotli data that an attacker could control.

Ok, so Qlik Sense Enterprise on Windows runs on Node.js 24.14.1.
I have the following questions:

1. Does the specific implementation of a vulnerable Node.js version in Qlik Sense Enterprise on Windows implicate a threat to installations of Qlik Sense?

2. Are there any migitating actions that can be undertaken by administrators to continue operating safely until Qlik Sense/Node.js is patched?

3. Is there a patch coming? If so, when is this expected to be made available?

Hi everyone,

I've been working on improving the structure and performance of my Qlik load scripts and front-end apps, and I want to make sure I'm following the most current best practices... not just what was recommended 3 or 4 years ago.

I'm looking for resources that cover topics like:

• Load script structure and organization
• Data model optimization (star schema, avoiding synthetic keys, QVD layers)
• Performance tuning (set analysis efficiency, AutoNumber, incremental loads)
• Naming conventions and maintainability

My question to the community: What are the most current and reliable sources you use to guide your development decisions? For example:

• Official Qlik help docs or whitepapers
• Community blogs or specific contributors you follow
• YouTube channels or webinars
• Internal standards your team has developed

Any links, authors, or resources you'd recommend would be greatly appreciated. Thanks in advance!

I'm trying to setup a block to retrieve trust score information from datasets in my tenant. According to documentation I need to use a Qlik Cloud Services - Raw API Request and point to  

api/data-governance/trust-scores/results/data-sets/actions/filter

After running the automation this is the response

{ "response": { "status": 404, "body": { "error": "Unknown Service (url: https://mytenantid.us.qlikcloud.com/api/data-governance/trust-scores/results/data-sets/actions/filter)" } }, "external error": false }

I've tried using curl to call this endpoint externally and it works fine. 

Qlik nPrinting upgrade from February 2024 sr1 to May 2026 sr2 creating issues.

Updtaed fine but at the first startup looks like I have communication issues between the engine and Rabbit.

Windows server 2019 and all running on same machine.

For example opening connections list, is blank and spinning and loading for ever.

Not sure someone else has same problems. Same issue if I try to upgrade to February 2025.

Log attached.

Hi there,

I'm using the REST APIs to create users in qlik cloud and after I've successfully created them, I need to assign them to a space - can do both of these actions without issue. The question is how can I suppress/disable the email notification being sent to that user's email address informing they've been granting access to that space?

Thanks.

Hi,

Has anyone replaced "Entitlement Analyzer" v1.0 with the latest which is v2.4, while keeping the history so we don't lose relevant "past information"?

Thank you.

Hi Qlik Fam,

In Qlik Application Automation, I have a list of emails in loop. Is there any way to get their user ID like:

67b41d9cb8f9db2519625a28

 to perform operations like role assignments and updates on multiple user IDs, because the Qlik operation block asks for a user ID to perform any operation.

Any suggestions would be highly appreciated.

Thanks and Regards,

VJ