PatchTheCVECVE-2026-66885: Cross-Site Request Forgery (CSRF) vulnerability in livebook-dev livebook allows an attacker to authenticate a
26
Routine
MEDIUM 6.5UPGRADE
CVE-2026-66885 is a medium-severity flaw (CVSS 6.5) affecting livebook. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Cross-Site Request Forgery (CSRF) vulnerability in livebook-dev livebook allows an attacker to authenticate a victim's browser session under the attacker's own Livebook Teams identity. When Livebook is configured to use Livebook Teams for identity, Livebook.ZTA.LivebookTeams.handle_request/4 in lib/livebook/zta/livebook_teams.ex handles the OAuth-style callback carrying a teams_identity marker and a code parameter. The clause exchanges that code
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.5 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | Required |
| EPSS exploit chance | 0.2% (top 86%) |
| CISA exploited list | No |
| Weakness | CWE-352 |
| Published | 2026-08-05 |
| Last modified | 2026-10-23 |
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
livebook livebook UPGRADE
Affected: >= 0.15.0 and < 0.18.7 · >= 0.19.0 and < 0.19.9
Fixed in: 0.18.7, 0.19.9
Safe to downgrade to: a release before 0.15.0
1. Check installed version
apt-cache policy livebook || rpm -q livebook || livebook --version
2. UPGRADE to 0.18.7 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade livebook
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade livebook
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 0.15.0 (Debian / Ubuntu)
apt-cache madison livebook
sudo apt install livebook=<VERSION_BEFORE_0.15.0>
sudo apt-mark hold livebook
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list livebook
sudo dnf downgrade livebook-<VERSION_BEFORE_0.15.0>
sudo dnf versionlock add livebook
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Related CVEs
- CVE-2026-66297 HIGH 8.0 UPGRADE Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) vulnerability in live
- CVE-2026-66881 HIGH 8.1 UPGRADE Relative Path Traversal vulnerability in livebook-dev livebook allows an attacker-authored notebook to write a
- CVE-2026-68746 HIGH 8.8 UPGRADE Not Failing Securely ('Failing Open') vulnerability in livebook-dev livebook allows an unauthenticated network
- CVE-2026-66298 HIGH 8.8 UPGRADE Origin Validation Error vulnerability in livebook-dev livebook allows untrusted notebook output JavaScript to