Police say the man has been arrested under Section 41 of the terrorism act, and that he remains in police custody.
When it exploded, numerous train riders suffered burns, and others were injured as they rushed away from the area of the blast.
A USA law enforcement source told CBS News senior investigative producer Pat Milton the device used in the attack was a white plastic bucket with a black cloth on top, with wires believed to be Christmas lights coming out of the bucket.
Deputy Assistant Police Commissioner Neil Basu called the arrest "significant", but cautioned that the investigation into the attack was ongoing and that the threat level in the United Kingdom remains "critical". "For strong investigative reasons we will not give any more details on the man we arrested at this stage", he said.
The threat level was last raised to critical following the Manchester Arena bombing in May, when 23 people, including the attacker, were killed as they exited a concert by U.S. popstar Ariana Grande. It partially detonated during rush hour.
A manhunt for the perpetrator is ongoing and police have reportedly identified a suspect.
It is the fourth time the terror threat level has been raised to critical in the last 11 years - most recently after the Manchester Arena bombing.
She said that due to the high threat of terrorist attacks in the coming days to the protection of sites, public access to which is restricted, will involve the military.
Detectives have spoken to 45 witnesses as part of their investigation and continue to take information via a confidential anti-terrorist hotline, police said.