CVE-2026-40110Jupyter Server is the backend for Jupyter web applications.
Updated under an hour ago ()
Does this affect you?
It affects jupyter_server. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the Origin header validation uses Python's re.match() to check incoming origins against the allow_origin_pat configuration value. Because re.match() only anchors at the start of the string and does not require a full match, a pattern intended to match only a trusted domain (e.g., trusted.example.com) will also match any origin that begins with that domain followed by additional characters (e.g., trusted.example.com.evil.com). An attacker who controls such a domain can bypass the CORS origin restriction and make cross-origin requests to the Jupyter Server API from an untrusted site. This issue has been fixed in version 2.18.0.
- CVSS
- 7.3 HIGH (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
- Weakness (CWE)
- CWE-777, CWE-625
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Not given
- NVD analysis
- Modified
- Record last updated
- Jul 24, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
jupyter jupyter_server jupyter:jupyter_server | before 2.18.0 | NVD |
References
- https://github.com/jupyter-server/jupyter_server/commit/057869a327c46730afede3eab0ca2d2e3e74aceapatch
- https://github.com/jupyter-server/jupyter_server/commit/49b34392feaa97735b3b777e3baf8f22f2a14ed8patch
- https://github.com/jupyter-server/jupyter_server/pull/603issue-tracking
- https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-24qx-w28j-9m6pmitigation, patch, vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:43038
- https://access.redhat.com/security/cve/CVE-2026-40110
- https://bugzilla.redhat.com/show_bug.cgi?id=2466912
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40110.json
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.