CVE-2026-40110highCWE-625CWE-777

CVE-2026-40110: falha de alta gravidade em jupyter-server jupyter_server

jupyter-server CORS origin validation bypass via unanchored regex in allow_origin_pat

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar jupyter server+ Monitorar jupyter-server

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.6epss 0.3%
Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the Origin header validation uses Python's re.match() to check incoming origins against the allow_origin_pat configuration value. Because re.match() only anchors at the start of the string and does not require a full match, a pattern intended to match only a trusted domain (e.g., trusted.example.com) will also match any origin that begins with that domain followed by additional characters (e.g., trusted.example.com.evil.com). An attacker who controls such a domain can bypass the CORS origin restriction and make cross-origin requests to the Jupyter Server API from an untrusted site. This issue has been fixed in version 2.18.0.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L
Produtos afetados
jupyter-server · jupyter_server
CVEs relacionadas — jupyter-server jupyter_server

No mesmo produto, das mais perigosas para as menos.

CVE-2020-26275MEDIUMOpen redirect vulnerabilityEPSS 1.4%CVE-2022-24757HIGHSensitive Auth & Cookie data stored in Jupyter server logsEPSS 1.3%CVE-2022-29241HIGHKnown or guessable hidden files may be accessed in Jupyter ServerEPSS 1.0%CVE-2023-49080LOWJupyter Server errors include tracebacks with path informationEPSS 0.8%CVE-2024-35178HIGHJupyter server on Windows discloses Windows user password hashEPSS 0.8%CVE-2023-39968MEDIUMOpen Redirect Vulnerability in jupyter-serverEPSS 0.7%