TI-2026-29520 Aliases CVE-2026-40864 GHSA-m68r-v472-jgq9

JupyterHub: Cross-origin form POSTs bypass XSRF

LOW 23CWE-352Published 2026-05-22 · Updated 2026-05-26

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Tampering
Confidentiality · integrity · availability: None · Low · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-352.

Summary

JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. In versions 4.1.0 through 5.4.4, XSRF protection (updated in 4.1.0) inappropriately treated requests with Sec-Fetch-Mode: no-cors as same-origin requests, bypassing XSRF checks. The JSON API is not affected, only HTTP form endpoints, such as /hub/spawn and /hub/accept-share, meaning attackers could trigger server spawn (but not access the server) and if the attacker is a JupyterHub user permitted to share access to their server, cause a user to accept a share and have access to the attacker's server. This issue has been fixed in version 5.4.5. If developers are unable to immediately upgrade, they can temporarily mitigate this issue by dropping requests to JupyterHub with Sec-Fetch-Mode: no-cors if they are using a reverse proxy.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00146 3rd percentileScored 2026-11-07

Fix Fixed jupyterhub (jupyterhub): 5.4.5jupyterhub (PyPI): 5.4.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
jupyterhub	jupyterhub	4.1.0 to before 5.4.5	5.4.5	Patch available	CNA
—	jupyterhub (PyPI)	4.1.0 to before 5.4.5	5.4.5	Patch available	GHSA-m68r-v472-jgq9

jupyterhub Vendorjupyterhub Affected 4.1.0 to before 5.4.5 Fixed in 5.4.5 Patch available CNA
jupyterhub (PyPI) Vendor— Affected 4.1.0 to before 5.4.5 Fixed in 5.4.5 Patch available GHSA-m68r-v472-jgq9

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:jupyter:jupyterhub::::::::	4.1.0 to before 5.4.5	Vulnerable	jupyterlab

cpe:2.3:a:jupyter:jupyterhub:*:*:*:*:*:*:*:* Versions 4.1.0 to before 5.4.5 Vulnerable ·jupyterlab

Remediation

Fix · CNA jupyterhub (jupyterhub) Fixed in 5.4.5
Fix · GHSA-m68r-v472-jgq9 jupyterhub (PyPI) Fixed in 5.4.5 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-40864
2026-10-03 Alias added: GHSA-m68r-v472-jgq9

References

Patch 1

https://github.com/jupyterhub/jupyterhub/commit/9c5ec277d3cda5a59de2d8c8117efa77bd941127

Advisory 2

Other 1

https://github.com/jupyterhub/jupyterhub

TI-2025-23499 Jupyter Remote Desktop Proxy makes TigerVNC accessible via the network and not just via a UNIX socket as intended CVSS 4.0CRITICAL 9.0
TI-2023-10877 JupyterHub's LTI13Authenticator: JWT signature not validated CVSS 3.1CRITICAL 10.0
TI-2021-16545 Remote code execution in Binderhub CVSS 3.1CRITICAL 9.8
TI-2021-18033 Improper Access Control in jupyterhub-firstuseauthenticator CVSS 3.1CRITICAL 9.8
TI-2021-16546 Code injection in nbgitpuller CVSS 3.1CRITICAL 9.6
TI-2024-18755 Jupyter Server Proxy's Websocket Proxying does not require authentication CVSS 3.1CRITICAL 9.8

See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences