CVE-2026-40110

HIGH EPSS 27.6%
Published May 5, 20261mo ago · Modified Jun 17, 20261w ago
7.6 CVSS 4.0
High
Find Similar
Published May 5, 2026 1mo ago
Last Modified Jun 17, 2026 1w ago

Description

Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the Origin header validation uses Python's re.match() to check incoming origins against the allow_origin_pat configuration value. Because re.match() only anchors at the start of the string and does not require a full match, a pattern intended to match only a trusted domain (e.g., trusted.example.com) will also match any origin that begins with that domain followed by additional characters (e.g., trusted.example.com.evil.com). An attacker who controls such a domain can bypass the CORS origin restriction and make cross-origin requests to the Jupyter Server API from an untrusted site. This issue has been fixed in version 2.18.0.

CVSS Details

Base Score
7.6
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction P
Scope X

Threat Intelligence

EPSS Exploit Probability
27.6% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-777

Affected Products 1

VendorProductVersionRange
jupyterjupyter_server* <2.18.0

References 4

  • github.com https://github.com/jupyter-server/jupyter_server/commit/057869a327c46730afede3eab0ca2d2e3e74acea
    Patch
  • github.com https://github.com/jupyter-server/jupyter_server/commit/49b34392feaa97735b3b777e3baf8f22f2a14ed8
    Patch
  • github.com https://github.com/jupyter-server/jupyter_server/pull/603
    Issue Tracking
  • github.com https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-24qx-w28j-9m6p
    MitigationPatchVendor Advisory

Remediation

  • github.com https://github.com/jupyter-server/jupyter_server/commit/057869a327c46730afede3eab0ca2d2e3e74acea
    Patch
  • github.com https://github.com/jupyter-server/jupyter_server/commit/49b34392feaa97735b3b777e3baf8f22f2a14ed8
    Patch
  • github.com https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-24qx-w28j-9m6p
    MitigationPatchVendor Advisory