PT-2026-37234 · Project Jupyter · Jupyter Server

Vnykmshr · Published 2026-05-05 · Updated 2026-05-11 · CVE-2026-40110

Positive Technologies (AI Summary)

CVSS v4.0

7.6

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L

Name of the Vulnerable Software and Affected Versions Jupyter Server versions prior to 2.18.0

Description Origin header validation uses the re.match() function to check incoming origins against the allow origin pat configuration value. Because re.match() only anchors at the start of the string and does not require a full match, a pattern intended for a trusted domain will also match any origin that begins with that domain followed by additional characters. This allows an attacker controlling such a domain to bypass Cross-Origin Resource Sharing (CORS) restrictions and make cross-origin requests to the Jupyter Server API from an untrusted site.

Recommendations Update to version 2.18.0. Wrap the allow origin pat value with ^ and $ to ensure a full string match.

Fix

Weakness Enumeration

CWE-777

Related Identifiers

CVE-2026-40110

GHSA-24QX-W28J-9M6P

OPENSUSE-SU-2026:10710-1

Affected Products

Jupyter Server

References · 23

• https://github.com/jupyter-server/jupyter_server/commit/057869a327c46730afede3eab0ca2d2e3e74acea · Patch
• https://github.com/jupyter-server/jupyter_server/commit/49b34392feaa97735b3b777e3baf8f22f2a14ed8 · Patch
• https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-24qx-w28j-9m6p · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-40110 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40110 · Security Note
• https://ubuntu.com/security/CVE-2026-40110 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-24qx-w28j-9m6p · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-40110 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-40110 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-40110 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10710-1 · Vendor Advisory
• https://github.com/jupyter-server/jupyter_server/pull/603 · Note
• https://github.com/jupyter-server/jupyter_server · Note
• https://twitter.com/UpwindMDR/status/2051719825617997874 · Twitter Post
• https://suse.com/security/cve/CVE-2026-40110 · Note