Vulnerability class

CSRF

Cross-site requests accepted as if the user had sent them.

1 write-up, 1 vulnerability

CVE-2026-40864

Highlighted 5.4 · Medium

05 May 2026 8 min

JupyterHub 4.1.0 to 5.4.4 skipped its XSRF check for any no-cors request, so a page on another origin could submit Hub forms for a logged-in user.

Vulnerabilities

Identifier	Product	Vulnerability	CVSS	Published
CVE-2026-40864	JupyterHub	XSRF bypass for no-cors requests	5.4 Medium	05 May 2026