CVE-2026-114135
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
Jupyter Server is the backend for Jupyter web applications. From 2.0.0 until 2.6.0, enabling GatewayClient.url replaced the normal KernelWebsocketHandler with WebSocketChannelsHandler, which authenticated the user but did not call authorizer.is_authorized(...) for the execute action on the kernels resource. A restricted authenticated user could therefore open an upstream kernel channel and obtain kernel execution despite the configured Authorizer denying that action, exposing data and credentials available to the kernel and permitting modification or disruption of the kernel environment. The default gateway configuration is fixed in version 2.6.0. In 2.6.0 and later, the same authorization bypass remains possible when a deployment manually registers the deprecated jupyter_server.gateway.handlers module, because its handler still omits the configured kernel-execute authorization decision.
Risk Assessment
A low-privileged user can gain unauthorized kernel code execution, leading to exposure of data and credentials and modification of the environment. This can result in privilege escalation and integrity compromise.
Recommendation
Update Jupyter Server to version 2.6.0 or later. Additionally, avoid manually registering the deprecated jupyter_server.gateway.handlers module and verify that the Authorizer configuration properly enforces kernel execution permissions.
Other vulnerabilities in Jupyter Server
See all- CVE-2026-86049High
Jupyter Server, the backend for Jupyter web applications, prior to version 2.21.0 copies the Referer header into a JSON header block in the 5xx request logging path without applying the token scrubbing used for the request URI. A request returning HTTP 500 whose Referer contains a token-bearing URL can write that token to server logs in plaintext.
- CVE-2026-44727Medium
Jupyter Server prior to version 2.20 has a stored XSS vulnerability in nbconvert handlers. A notebook with an HTML payload in display_data output can lead to cookie theft, full API access, and kernel RCE.
- CVE-2026-6657High
In jupyter-server versions 1.12.0 through 2.17.0, a vulnerability allows bypassing CORS origin validation when using `allow_origin_pat`. The issue is due to `re.match()` only anchoring at the start, allowing attacker-controlled domains like `trusted.example.com.evil.com` to pass validation for patterns intended for `trusted.example.com`. This affects CORS headers, WebSocket connections, referer validation, and login redirects, potentially enabling phishing, arbitrary code execution, and unauthorized access to sensitive API responses.
- CVE-2026-5422High
A path traversal vulnerability in jupyter-server 2.17.0 due to an incorrect root directory boundary check in the _get_os_path() function. This allows unauthorized read/write access to files in sibling directories.
- CVE-2026-40934Medium
Jupyter Server up to version 2.17.0 persists the secret used to sign authentication cookies to a static file and does not rotate it after a password change. After a password reset and server restart, previously issued cookies remain valid, allowing an attacker who captured a session cookie to retain access despite the password change.
- CVE-2026-40110High
Jupyter Server versions 2.17.0 and earlier use re.match() for Origin header validation, allowing bypass of CORS restrictions. An attacker controlling a domain like trusted.example.com.evil.com can make cross-origin requests to the server API.
- CVE-2026-35397High
Jupyter Server versions 2.17.0 and earlier contain a path traversal vulnerability in the REST API that allows an authenticated user to escape the configured root_dir and access sibling directories whose names begin with the same prefix as the root_dir. An attacker can read, write, and delete files in affected sibling directories. Multi-tenant deployments with predictable naming schemes are particularly at risk. Version 2.18.0 contains a fix.
- CVE-2025-61669Medium
Jupyter Server versions through 2.17.0 have insufficient validation of the next query parameter in the login flow within LoginFormHandler._redirect_safe(), allowing redirects to arbitrary external domains. An attacker can use a crafted login URL to redirect users to a malicious site and facilitate phishing attacks.
- CVE-2023-40170Medium
In jupyter-server, improper cross-site credential checks on `/files/` URLs could allow exposure of certain file contents or accessing files when opening untrusted files. This issue has been addressed in version `2.7.2`.
- CVE-2023-39968Medium
The vulnerability in jupyter-server allows for an Open Redirect attack, enabling redirection of users to arbitrary sites after logging into a Jupyter server. Maliciously crafted login links can lead to unauthorized redirects.
Original NVD description (English source)
Jupyter Server is the backend for Jupyter web applications. From 2.0.0 until 2.6.0, enabling GatewayClient.url replaced the normal KernelWebsocketHandler with WebSocketChannelsHandler, which authenticated the user but did not call authorizer.is_authorized(...) for the execute action on the kernels resource. A restricted authenticated user could therefore open an upstream kernel channel and obtain kernel execution despite the configured Authorizer denying that action, exposing data and credentials available to the kernel and permitting modification or disruption of the kernel environment. The default gateway configuration is fixed in version 2.6.0. In 2.6.0 and later, the same authorization bypass remains possible when a deployment manually registers the deprecated jupyter_server.gateway.handlers module, because its handler still omits the configured kernel-execute authorization decision.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS