PT-2026-37244 · Unknown · Jupyterhub

Romain-Deperne · Published 2026-05-05 · Updated 2026-06-01 · CVE-2026-40864

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions JupyterHub versions 4.1.0 through 5.4.4

Description XSRF protection inappropriately treated requests containing the Sec-Fetch-Mode: no-cors header as same-origin requests, allowing the bypass of XSRF checks. This affects HTTP form endpoints, such as '/hub/spawn' and '/hub/accept-share', while the JSON API remains unaffected. An attacker could trigger a server spawn or, if permitted to share server access, force a user to accept a share and gain access to the attacker's server.

Recommendations Update to version 5.4.5. As a temporary mitigation, if using a reverse proxy, drop requests to JupyterHub that contain the Sec-Fetch-Mode: no-cors header.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

BIT-JUPYTERHUB-2026-40864

CVE-2026-40864

GHSA-M68R-V472-JGQ9

Affected Products

Jupyterhub

References · 15

• https://github.com/jupyterhub/jupyterhub/security/advisories/GHSA-m68r-v472-jgq9 · Vendor Advisory
• https://github.com/jupyterhub/jupyterhub/commit/9c5ec277d3cda5a59de2d8c8117efa77bd941127 · Patch
• https://osv.dev/vulnerability/GHSA-m68r-v472-jgq9 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-40864 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-40864 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-40864 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-40864 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40864 · Security Note
• https://ubuntu.com/security/CVE-2026-40864 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-jupyterhub-2026-40864 · Vendor Advisory
• https://github.com/jupyterhub/jupyterhub · Note
• https://twitter.com/CVEnew/status/2058155781103763674 · Twitter Post
• https://t.me/cveNotify/165504 · Telegram Post
• https://t.me/cveNotify/164747 · Telegram Post
• https://t.me/CVEtracker/54673 · Telegram Post