PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-66885 livebook-dev CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-05T20:17:13.007Z and has not been modified since then. The CVE-2026-66885 issue arises from a Cross-Site Request Forgery (CSRF) vulnerability in livebook-dev livebook. When Livebook is configured to use Livebook Teams for identity, an attacker can authenticate a victim's browser session under the attacker's own Livebook Teams identity. This occurs because the OAuth-style callback handles a teams_identity marker and a code parameter without verifying any value that ties the callback to the browser session that started the login. The consequence is that a user believes they are working in their own authenticated session while they are in fact operating as another identity. Work performed in that session is attributed to the attacker's account, and secrets, uploaded data, or notebook results the victim produces are exposed to the attacker rather than kept in the victim's own account. The authorization code must be redeemed within a short window after the login flow begins, which constrains the timing of the attack but not its feasibility. This issue affects livebook: from 0.15.0 before 0.18.7 and from 0.19.0 before 0.19.9.

Vendor
livebook-dev
Product
livebook
CVSS
MEDIUM 6.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-05
Original CVE updated
2026-08-06
Advisory published
2026-08-05
Advisory updated
2026-08-06

Who should care

Livebook users and administrators should be aware of this vulnerability and take steps to protect their instances. Livebook users should verify their version and apply updates to prevent session hijacking via CSRF. Implement additional CSRF protections for Livebook Teams authentication. Monitor Livebook sessions for suspicious activity. Restrict Livebook access to trusted users and networks. Review and update Livebook configuration to ensure secure authentication. Livebook users should also review their Livebook Teams configuration and ensure that it is properly secured.

Technical summary

The CVE-2026-66885 issue arises from a Cross-Site Request Forgery (CSRF) vulnerability in livebook-dev livebook. When Livebook is configured to use Livebook Teams for identity, an attacker can authenticate a victim's browser session under the attacker's own Livebook Teams identity. This occurs because the OAuth-style callback handles a teams_identity marker and a code parameter without verifying any value that ties the callback to the browser session that started the login.

Defensive priority

Livebook users should verify their version and apply updates to prevent session hijacking via CSRF.

Recommended defensive actions

  • Verify Livebook version and apply updates to prevent session hijacking via CSRF
  • Implement additional CSRF protections for Livebook Teams authentication
  • Monitor Livebook sessions for suspicious activity
  • Restrict Livebook access to trusted users and networks
  • Review and update Livebook configuration to ensure secure authentication

Evidence notes

The CVE-2026-66885 issue arises from a Cross-Site Request Forgery (CSRF) vulnerability in livebook-dev livebook. When Livebook is configured to use Livebook Teams for identity, an attacker can authenticate a victim's browser session under the attacker's own Livebook Teams identity. This occurs because the OAuth-style callback handles a teams_identity marker and a code parameter without verifying any value that ties the callback to the browser session that started the login. The consequence is that a user believes they are working in their own authenticated session while they are in fact operating as another identity.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-66885 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-66885

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-66885 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-66885

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://cna.erlef.org/cves/CVE-2026-66885.html

    6b3ad84c-e1a6-4bf7-a703-f496b71e49db

  • Source reference

    Unverified legacy reference

    URL: https://github.com/livebook-dev/livebook/commit/21c16168263275541a6e076d0c31852c40e09a18

    6b3ad84c-e1a6-4bf7-a703-f496b71e49db

  • Source reference

    Unverified legacy reference

    URL: https://github.com/livebook-dev/livebook/commit/33a052daa386c4ce08a9c39a07fc90f353ff6a51

    6b3ad84c-e1a6-4bf7-a703-f496b71e49db

  • Source reference

    Unverified legacy reference

    URL: https://github.com/livebook-dev/livebook/commit/6ed2e213e9d5a19a70d7fcad5a8d616622cd2084

    6b3ad84c-e1a6-4bf7-a703-f496b71e49db

  • Source reference

    Unverified legacy reference

    URL: https://github.com/livebook-dev/livebook/security/advisories/GHSA-pvvw-28fw-c6fg

    6b3ad84c-e1a6-4bf7-a703-f496b71e49db

  • Source reference

    Unverified legacy reference

    URL: https://osv.dev/vulnerability/EEF-CVE-2026-66885

    6b3ad84c-e1a6-4bf7-a703-f496b71e49db

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.