CVE-2026-40110highCWE-625CWE-777

CVE-2026-40110: fallo de gravedad alta en jupyter-server jupyter_server

jupyter-server CORS origin validation bypass via unanchored regex in allow_origin_pat

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear jupyter server+ Monitorear jupyter-server

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.6epss 0.3%
Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the Origin header validation uses Python's re.match() to check incoming origins against the allow_origin_pat configuration value. Because re.match() only anchors at the start of the string and does not require a full match, a pattern intended to match only a trusted domain (e.g., trusted.example.com) will also match any origin that begins with that domain followed by additional characters (e.g., trusted.example.com.evil.com). An attacker who controls such a domain can bypass the CORS origin restriction and make cross-origin requests to the Jupyter Server API from an untrusted site. This issue has been fixed in version 2.18.0.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L
Productos afectados
jupyter-server · jupyter_server
CVEs relacionadas — jupyter-server jupyter_server

En el mismo producto, de las más peligrosas a las menos.

CVE-2020-26275MEDIUMOpen redirect vulnerabilityEPSS 1.4%CVE-2022-24757HIGHSensitive Auth & Cookie data stored in Jupyter server logsEPSS 1.3%CVE-2022-29241HIGHKnown or guessable hidden files may be accessed in Jupyter ServerEPSS 1.0%CVE-2023-49080LOWJupyter Server errors include tracebacks with path informationEPSS 0.8%CVE-2024-35178HIGHJupyter server on Windows discloses Windows user password hashEPSS 0.8%CVE-2023-39968MEDIUMOpen Redirect Vulnerability in jupyter-serverEPSS 0.7%