Cross-site request forgery in jupyterhub - CVE-2026-40864
Published: November 9, 2026
Vulnerability identifier: #VU162712
CSH Severity: Medium
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-40864
CWE-ID: CWE-352
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to trigger server spawning without gaining access to the server.
The vulnerability exists due to JupyterHub's HTTP form XSRF protection incorrectly treating requests with Sec-Fetch-Mode: no-cors as same-origin requests. An unauthenticated remote attacker can lure a signed-in user to a malicious page that submits cross-origin forms, also forcing share acceptance if the attacker has a JupyterHub account permitted to share their server.
Affected software
jupyterhub
How to mitigate CVE-2026-40864
Install security update from vendor's website.
jupyterhub - update to 5.4.5