CVE-2026-40864: JupyterHub: Cross-origin form POSTs bypass XSRF
Summary
JupyterHub's XSRF protection (updated in 4.1.0) inappropriately treated requests with Sec-Fetch-Mode: no-cors as same-origin requests, which they are not, bypassing XSRF checks. The JSON API is not affected, only HTTP form endpoints, such as /hub/spawn and /hub/accept-share, meaning attackers could trigger server spawn (but not access the server) and if the attacker is a JupyterHub user permitted to share access to their server, cause a user to accept a share and have access to the attacker's server.
Patches
Upgrade to JupyterHub 5.4.5.
Mitigations
If a reverse proxy is in use, drop requests to JupyterHub with Sec-Fetch-Mode: no-cors.
Other sources
JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. In versions 4.1.0 through 5.4.4, XSRF protection (updated in 4.1.0) inappropriately treated requests with Sec-Fetch-Mode: no-cors as same-origin requests, bypassing XSRF checks. The JSON API is not affected, only HTTP form endpoints, such as /hub/spawn and /hub/accept-share, meaning attackers could trigger server spawn (but not access the server) and if the attacker is a JupyterHub user permitted to share access to their server, cause a user to accept a share and have access to the attacker's server. This issue has been fixed in version 5.4.5. If developers are unable to immediately upgrade, they can temporarily mitigate this issue by dropping requests to JupyterHub with Sec-Fetch-Mode: no-cors if they are using a reverse proxy.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/jupyterhubto a version that resolves this vulnerability.Fixed in 5.4.5 - Upgrade
Upgrade
JupyterHubto a version that resolves this vulnerability.Fixed in 5.4.5 - Compensating control
If a reverse proxy is in use, drop requests to JupyterHub that contain the header Sec-Fetch-Mode: no-cors. This is a temporary mitigation for versions 4.1.0 through 5.4.4 where XSRF protection inappropriately treats Sec-Fetch-Mode: no-cors as same-origin and bypasses XSRF checks.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40864?
CVE-2026-40864 has been classified as a high severity vulnerability due to its potential to bypass XSRF protections.
How do I fix CVE-2026-40864?
To fix CVE-2026-40864, you should upgrade to JupyterHub version 5.4.5 or later.
Which JupyterHub versions are affected by CVE-2026-40864?
JupyterHub versions from 4.1.0 to 5.4.4 are affected by CVE-2026-40864.
What endpoints are impacted by CVE-2026-40864?
CVE-2026-40864 affects HTTP form endpoints such as /hub/spawn and /hub/accept-share.
Does CVE-2026-40864 affect the JSON API of JupyterHub?
No, CVE-2026-40864 does not affect the JSON API of JupyterHub, only the HTTP form endpoints.