CVE-2026-66885: Livebook Teams CSRF Vulnerability

CVE-2026-66885 Overview

CVE-2026-66885 is a Cross-Site Request Forgery (CSRF) vulnerability in Livebook, the interactive notebook platform for the Elixir programming language. The flaw affects deployments configured to use Livebook Teams for identity. An attacker who is a member of the same Livebook Teams organisation can initiate an OAuth-style login flow, retain the authorization code, and trick a victim into completing the exchange. The victim's browser session then binds to the attacker's identity, causing the victim's work, secrets, and uploaded data to be attributed to and accessible by the attacker. This weakness is categorized under CWE-352.

Critical Impact
Victims believe they are working in their own authenticated session while their notebook results, secrets, and uploaded data are silently exposed to the attacker's Livebook Teams account.

Affected Products

Livebook versions 0.15.0 through 0.18.6
Livebook versions 0.19.0 through 0.19.8
Livebook deployments configured with Livebook Teams identity provider

Discovery Timeline

2026-08-05 - CVE CVE-2026-66885 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-66885

Vulnerability Analysis

The vulnerability resides in Livebook.ZTA.LivebookTeams.handle_request/4 inside lib/livebook/zta/livebook_teams.ex. This function processes the OAuth-style callback that carries a teams_identity marker together with a code parameter. The clause exchanges the code for an access token and writes it into the browser session without verifying any value that ties the callback back to the browser that initiated the login. Attackers who belong to the same Livebook Teams organisation as the target instance can start a login flow, keep the resulting authorization code, and lure a victim into visiting a URL that carries that code. The victim's browser completes the token exchange, and the session becomes bound to the attacker's identity. Notebook activity, secrets, and outputs produced by the victim are then written into the attacker's account.

Root Cause

No state or nonce is generated when the login flow begins. Livebook.Teams.Requests.create_auth_request/1 in lib/livebook/teams/requests.ex sends an empty request body, so no per-attempt token is registered. The callback handler therefore has no anti-CSRF value to compare against and accepts any code presented by any browser.

Attack Vector

Exploitation requires the attacker to hold membership in the same Livebook Teams organisation as the target instance. The attacker initiates the OAuth flow, captures the authorization code without redeeming it, and delivers a crafted URL to the victim. The code must be redeemed within a short window after the flow starts, which constrains timing but not feasibility. The victim needs no special privileges, and no victim credentials are involved.

text

     |> redirect(external: url)
   end
 
-  defp handle_request(conn, team, %{"teams_identity" => _, "code" => code}) do
-    with {:ok, access_token} <- retrieve_access_token(team, code),
-         {:ok, metadata} <- get_user_info(team, access_token) do
-      {conn
-       |> put_session(:livebook_teams_access_token, access_token)
-       |> redirect(to: conn.request_path)
-       |> halt(), metadata}
+  defp handle_request(conn, team, %{"teams_identity" => _} = params) do
+    if valid_auth_state?(conn, params) do
+      conn = delete_session(conn, :teams_auth_state)
+      handle_identity_callback(conn, team, params)
     else
-      _ ->
-        {conn
-         |> put_session(:teams_error, true)
-         |> redirect(to: conn.request_path)
-         |> halt(), nil}
+      restart_user_authentication(conn)
     end
   end

Source: GitHub Livebook Commit 6ed2e21. The patch introduces valid_auth_state?/2, which compares a per-session teams_auth_state value against the callback parameters and restarts authentication if the state does not match.

Detection Methods for CVE-2026-66885

Indicators of Compromise

Livebook Teams callback requests containing teams_identity and code parameters that arrive from external referrers or unexpected user-agent strings.
Session bindings where the user identity resolved from livebook_teams_access_token differs from the account the user believes they are logged in as.
Notebook activity, secrets creation, or file uploads attributed to a Livebook Teams member who did not physically operate the affected browser.

Detection Strategies

Inspect Livebook web server access logs for callback URLs containing teams_identity that originate from cross-site navigations or email links.
Correlate Livebook Teams audit records with endpoint activity to spot cases where the notebook host and the authenticated identity belong to different users.
Alert on repeated failed or rapid-succession authorization code redemptions from the same Teams organisation.

Monitoring Recommendations

Enable audit logging in Livebook Teams and forward events to your central log platform for retention and correlation.
Track version strings reported by Livebook instances and flag any deployment still running 0.15.0-0.18.6 or 0.19.0-0.19.8.
Monitor for anomalous secret access or notebook downloads shortly after a fresh Livebook Teams authentication event.

How to Mitigate CVE-2026-66885

Immediate Actions Required

Upgrade Livebook to version 0.18.7 if running the 0.15.x-0.18.x branch, or to version 0.19.9 if running the 0.19.x branch.
Rotate any secrets, tokens, or credentials that were stored in Livebook notebooks during the exposure window.
Review Livebook Teams audit logs for suspicious authentication callbacks and session bindings that predate the upgrade.

Patch Information

The fix is delivered in Livebook 0.18.7 and 0.19.9. It generates a per-session teams_auth_state value when the authentication flow starts and validates that value in handle_request/4 before writing the access token into the session. Details are published in the GitHub Security Advisory GHSA-pvvw-28fw-c6fg and the CNA CVE-2026-66885 Detail. Supporting commits include 21c1616, 33a052d, and 6ed2e21.

Workarounds

Restrict Livebook Teams organisation membership to trusted users until the patched version is deployed.
Require users to open Livebook only from bookmarks or the internal portal, avoiding externally supplied Livebook URLs.
Terminate active Livebook sessions after upgrade to force re-authentication under the fixed state-validated flow.

bash

# Verify installed Livebook version and upgrade
livebook --version

# Upgrade via Mix escript install
mix escript.install hex livebook 0.19.9

# Or pull the patched Docker image
docker pull ghcr.io/livebook-dev/livebook:0.19.9
docker stop livebook && docker rm livebook
docker run -d --name livebook -p 8080:8080 ghcr.io/livebook-dev/livebook:0.19.9