SB2026110968 - Cross-site request forgery in jupyterhub

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026110968

SB2026110968 - Cross-site request forgery in jupyterhub

Published: November 9, 2026

Security Bulletin ID SB2026110968
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Cross-site request forgery (CVE-ID: CVE-2026-40864)

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to trigger server spawning without gaining access to the server.

The vulnerability exists due to JupyterHub's HTTP form XSRF protection incorrectly treating requests with Sec-Fetch-Mode: no-cors as same-origin requests. An unauthenticated remote attacker can lure a signed-in user to a malicious page that submits cross-origin forms, also forcing share acceptance if the attacker has a JupyterHub account permitted to share their server.


Remediation

Install update from vendor's website.

References