PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-66885 livebook-dev CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-05T20:17:13.007Z and has not been modified since then. The CVE-2026-66885 issue arises from a Cross-Site Request Forgery (CSRF) vulnerability in livebook-dev livebook. When Livebook is configured to use Livebook Teams for identity, an attacker can authenticate a victim's browser session under the attacker's own Livebook Teams identity. This occurs because the OAuth-style callback handles a teams_identity marker and a code parameter without verifying any value that ties the callback to the browser session that started the login. The consequence is that a user believes they are working in their own authenticated session while they are in fact operating as another identity. Work performed in that session is attributed to the attacker's account, and secrets, uploaded data, or notebook results the victim produces are exposed to the attacker rather than kept in the victim's own account. The authorization code must be redeemed within a short window after the login flow begins, which constrains the timing of the attack but not its feasibility. This issue affects livebook: from 0.15.0 before 0.18.7 and from 0.19.0 before 0.19.9.

Vendor
livebook-dev
Product
livebook
CVSS
MEDIUM 6.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-05
Original CVE updated
2026-08-05
Advisory published
2026-08-05
Advisory updated
2026-08-05

Who should care

Livebook users and administrators should be aware of this vulnerability and take steps to protect their instances. Livebook users should verify their version and apply updates to prevent session hijacking via CSRF. Implement additional CSRF protections for Livebook Teams authentication. Monitor Livebook sessions for suspicious activity. Restrict Livebook access to trusted users and networks. Review and update Livebook configuration to ensure secure authentication. Livebook users should also review their Livebook Teams configuration and ensure that it is properly secured.

Technical summary

The CVE-2026-66885 issue arises from a Cross-Site Request Forgery (CSRF) vulnerability in livebook-dev livebook. When Livebook is configured to use Livebook Teams for identity, an attacker can authenticate a victim's browser session under the attacker's own Livebook Teams identity. This occurs because the OAuth-style callback handles a teams_identity marker and a code parameter without verifying any value that ties the callback to the browser session that started the login.

Defensive priority

Livebook users should verify their version and apply updates to prevent session hijacking via CSRF.

Recommended defensive actions

  • Verify Livebook version and apply updates to prevent session hijacking via CSRF
  • Implement additional CSRF protections for Livebook Teams authentication
  • Monitor Livebook sessions for suspicious activity
  • Restrict Livebook access to trusted users and networks
  • Review and update Livebook configuration to ensure secure authentication

Evidence notes

The CVE-2026-66885 issue arises from a Cross-Site Request Forgery (CSRF) vulnerability in livebook-dev livebook. When Livebook is configured to use Livebook Teams for identity, an attacker can authenticate a victim's browser session under the attacker's own Livebook Teams identity. This occurs because the OAuth-style callback handles a teams_identity marker and a code parameter without verifying any value that ties the callback to the browser session that started the login. The consequence is that a user believes they are working in their own authenticated session while they are in fact operating as another identity.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-05T20:17:13.007Z and has not been modified since then.