← Vulnerability feed

Vulnerability record · CVE-2026-40110 · published 5 May 2026

CVE-2026-40110: Jupyter server vulnerability

Jupyter · Jupyter Server

Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the Origin header validation uses Python's re.match() to check incoming origins against the allow_origin_pat configuration value. Because re.match() only anchors at the start of the string and does not require a full match, a pattern intended to match only a trusted domain (e.g., trusted.example.com) will also match any origin that begins with that domain followed by additional characters (e.g., trusted.example.com.evil.com). An attacker who controls such a domain can bypass the CORS origin restriction and make cross-origin requests to the Jupyter Server API from an untrusted site. This issue has been fixed in version 2.18.0.

7.6 CVSS 4.0 High EPSS 0.47% · top 61.8% CWE-777 · CWE-777CWE-625 · CWE-625
7.6CVSS 4.0 base score
0.47%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
8References
24 Jul 2026Last modified by NVD

Description

Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the Origin header validation uses Python's re.match() to check incoming origins against the allow_origin_pat configuration value. Because re.match() only anchors at the start of the string and does not require a full match, a pattern intended to match only a trusted domain (e.g., trusted.example.com) will also match any origin that begins with that domain followed by additional characters (e.g., trusted.example.com.evil.com). An attacker who controls such a domain can bypass the CORS origin restriction and make cross-origin requests to the Jupyter Server API from an untrusted site. This issue has been fixed in version 2.18.0.

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/jupyter-server/jupyter_server/commit/057869a327c46730afede3eab0ca2d2e3e74acea Patch
https://github.com/jupyter-server/jupyter_server/commit/49b34392feaa97735b3b777e3baf8f22f2a14ed8 Patch
https://github.com/jupyter-server/jupyter_server/pull/603 Issue Tracking
https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-24qx-w28j-9m6p MitigationPatchVendor Advisory
https://access.redhat.com/errata/RHSA-2026:43038
https://access.redhat.com/security/cve/CVE-2026-40110
https://bugzilla.redhat.com/show_bug.cgi?id=2466912
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40110.json

Track CVE-2026-40110 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.3CVE-2026-44727Jupyter server cross-site scripting vulnerabilityJupyter Server is the backend for Jupyter web applications. Prior to 2.20, the nbconvert HTTP handlers in jupyter_server render user-authored noteboo…EPSS 0.44%8.8CVE-2026-6657Jupyter server origin validation error vulnerabilityA vulnerability in jupyter-server versions 1.12.0 through 2.17.0 allows an attacker to bypass CORS origin validation when the `allow_origin_pat` conf…EPSS 0.27%8.8CVE-2022-29241Jupyter server information exposure vulnerabilityJupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications like Jupyter Notebook. Prior to v…EPSS 0.95%8.1CVE-2026-5422Jupyter server relative path traversal vulnerabilityA path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check in the _get_os_path() functi…EPSS 0.55%7.6CVE-2026-40934Jupyter server insufficient session expiration vulnerabilityJupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the secret used to sign authentication cookies is persist…EPSS 0.38%7.6CVE-2026-35397Jupyter server path traversal vulnerabilityJupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, a path traversal vulnerability in the REST API allows an …EPSS 0.67%7.5CVE-2024-35178Jupyter server information exposure vulnerabilityThe Jupyter Server provides the backend for Jupyter web applications. Jupyter Server on Windows has a vulnerability that lets unauthenticated attacke…EPSS 0.71%7.5CVE-2022-24757Jupyter server sensitive information in log file vulnerabilityThe Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications. Prior to version 1.15.4, una…EPSS 1.3%

Source: NIST National Vulnerability Database (record CVE-2026-40110), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.