CVE-2026-40864

JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. In versions 4.1.0 through 5.4.4, XSRF protection (updated in 4.1.0) inappropriately treated requests with Sec-Fetch-Mode: no-cors as same-origin requests, bypassing XSRF checks. The JSON API is not affected, only HTTP form endpoints, such as /hub/spawn and /hub/accept-share, meaning attackers could trigger server spawn (but not access the server) and if the attacker is a JupyterHub user permitted to share access to their server, cause a user to accept a share and have access to the attacker's server. This issue has been fixed in version 5.4.5. If developers are unable to immediately upgrade, they can temporarily mitigate this issue by dropping requests to JupyterHub with Sec-Fetch-Mode: no-cors if they are using a reverse proxy.

• CWE-352

• https://github.com/jupyterhub/jupyterhub/commit/9c5ec277d3cda5a59de2d8c8117efa77bd941127Patch
• https://github.com/jupyterhub/jupyterhub/security/advisories/GHSA-m68r-v472-jgq9Mitigation, Vendor Advisory

Published

May 22, 2026

Last Modified

Jul 23, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-40858The camel-infinispan component's ProtoStream-based remote ag…8.8
• CVE-2026-40859Deserialization of Untrusted Data vulnerability in Apache Ca…8.1
• CVE-2026-4086The WP Random Button plugin for WordPress is vulnerable to S…6.4
• CVE-2026-40860JmsBinding.extractBodyFromJms() in camel-jms, and the equiva…9.8
• CVE-2026-40861A Dag author could either (a) create a symlink under their t…6.5
• CVE-2026-40863PhpSpreadsheet is a pure PHP library for reading and writing…7.5
• CVE-2026-40865Horilla is a free and open source Human Resource Management …7.1
• CVE-2026-40866Horilla is a free and open source Human Resource Management …8.6
• CVE-2026-40867Horilla is a free and open source Human Resource Management …7.1
• CVE-2026-40868Kyverno is a policy engine designed for cloud native platfor…8.1
• CVE-2026-40869Decidim is a participatory democracy framework. Starting in …6.5
• CVE-2026-4087The Pre* Party Resource Hints plugin for WordPress is vulner…6.5