[ANN] JupyterHub security release: 5.4.5

JupyterHub
1

We’ve released JupyterHub 5.4.5, which fixes a moderate cross-site request forgery vulnerability. This release is also available in version 4.3.4 of the helm chart.

The advisory (CVE-2026-40864) will be posted publicly in seven days (2026-05-05).

2

Could this be related? Launcher Notebook and Console icons not rendered in JupyterHub · Issue #18839 · jupyterlab/jupyterlab · GitHub

3

sigh yes, and I think I know what the fix is. Sorry about that.

4

allow no-cors GETs from same-origin by minrk · Pull Request #5380 · jupyterhub/jupyterhub · GitHub should be the fix for that

5

5.4.6 should be out with a fix, as well as z2jh 4.3.5