CVE-2026-40864

CVE-2026-40864 — JupyterHub XSRF bypass via cross-origin form POST Sec-Fetch-Mode: no-cors Severity : Medium CVSS 5.4 CWE : CWE-352 — Cross-Site Request Forgery XSRF Affected : jupyterhub 4.1.0 ≤ version 5.4.5 patched in 5.4.5 Advisory : GHSA-m68r-v472-jgq9 NVD :...

GHSA-M68R-V472-JGQ9 JupyterHub has cross-origin form POSTs bypass XSRF (CWE-352)

Summary JupyterHub's XSRF protection updated in 4.1.0 inappropriately treated requests with Sec-Fetch-Mode: no-cors as same-origin requests, which they are not, bypassing XSRF checks. The JSON API is not affected, only HTTP form endpoints, such as /hub/spawn and /hub/accept-share, meaning attacke...