{"id":"CVE-2026-40864","aliases":["GHSA-m68r-v472-jgq9","BIT-jupyterhub-2026-40864","PYSEC-2026-2189"],"title":"JupyterHub has cross-origin form POSTs bypass XSRF (CWE-352)","summary":"JupyterHub has cross-origin form POSTs bypass XSRF (CWE-352)","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","vendor":"jupyterhub","product":"jupyterhub","ecosystem":"pip","affected":["jupyterhub >= 4.1.0, < 5.4.5"],"patched":["jupyterhub 5.4.5"],"published":"2026-05-05","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:51:06.307577438Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-m68r-v472-jgq9","references":[{"url":"https://github.com/jupyterhub/jupyterhub/security/advisories/GHSA-m68r-v472-jgq9"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40864"},{"url":"https://github.com/jupyterhub/jupyterhub/commit/9c5ec277d3cda5a59de2d8c8117efa77bd941127"},{"url":"https://github.com/jupyterhub/jupyterhub"}],"tags":["osv","pip","exploit-available"],"epss":0.00159,"epssPercentile":0.05445,"exploits":{"github":1,"githubRepos":["https://github.com/romain-deperne/CVE-2026-40864"],"checkedAt":"2026-09-24T07:53:03.200Z"},"exploitAvailable":true,"ingestedAt":"2026-07-13T18:58:00.344Z","slug":"CVE-2026-40864","body":"## Overview\n\n## Summary\n\nJupyterHub's XSRF protection (updated in 4.1.0) inappropriately treated requests with `Sec-Fetch-Mode: no-cors` as same-origin requests, which they are not, bypassing XSRF checks. The JSON API is not affected, only HTTP form endpoints, such as `/hub/spawn` and `/hub/accept-share`, meaning attackers could trigger server spawn (but not access the server) and if the attacker is a JupyterHub user permitted to share access to their server, cause a user to accept a share and have access to the attacker's server.\n\n## Patches\n\nUpgrade to JupyterHub 5.4.5.\n\n## Mitigations\n\nIf a reverse proxy is in use, drop requests to JupyterHub with `Sec-Fetch-Mode: no-cors`.\n\n## Affected packages\n\n- `jupyterhub >= 4.1.0, < 5.4.5`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `jupyterhub 5.4.5`","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":29.7,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":5178,"id":"CVE-2026-40864","ts":1788887251635,"field":"exploit_available","old":"false","new":"true"},{"seq":4061,"id":"CVE-2026-40864","ts":1788886367588,"field":"exploit_available","old":"true","new":"false"},{"seq":2852,"id":"CVE-2026-40864","ts":1788883034184,"field":"exploit_available","old":"false","new":"true"},{"seq":1881,"id":"CVE-2026-40864","ts":1788882437096,"field":"exploit_available","old":"true","new":"false"},{"seq":978,"id":"CVE-2026-40864","ts":1788881871384,"field":"exploit_available","old":"false","new":"true"}]}