CVE-2026-40864

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-40864
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40864.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-40864
Aliases
Downstream
Related
Published
2026-05-22T20:13:05.262Z
Modified
2026-07-15T01:48:55.262373490Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L CVSS Calculator
Summary
JupyterHub: Cross-origin form POSTs bypass XSRF
Details

JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. In versions 4.1.0 through 5.4.4, XSRF protection (updated in 4.1.0) inappropriately treated requests with Sec-Fetch-Mode: no-cors as same-origin requests, bypassing XSRF checks. The JSON API is not affected, only HTTP form endpoints, such as /hub/spawn and /hub/accept-share, meaning attackers could trigger server spawn (but not access the server) and if the attacker is a JupyterHub user permitted to share access to their server, cause a user to accept a share and have access to the attacker's server. This issue has been fixed in version 5.4.5. If developers are unable to immediately upgrade, they can temporarily mitigate this issue by dropping requests to JupyterHub with Sec-Fetch-Mode: no-cors if they are using a reverse proxy.

Database specific 
{
    "cwe_ids": [
        "CWE-352"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40864.json"
}
References

Affected packages

Git / github.com/jupyterhub/jupyterhub

Affected ranges

Type
GIT
Repo
https://github.com/jupyterhub/jupyterhub
Events
Introduced
984a67932ffcd2a1024c7f23636f7e34e7df33ac
Fixed
edfb81dba2d45e9a243de4c4b65c3e94ca53932f
Fixed
9c5ec277d3cda5a59de2d8c8117efa77bd941127
Database specific 
{
    "extracted_events": [
        {
            "introduced": "4.1.0"
        },
        {
            "fixed": "5.4.5"
        }
    ],
    "cpe": "cpe:2.3:a:jupyter:jupyterhub:*:*:*:*:*:*:*:*",
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40864.json"