PT-2026-37241 · Project Jupyter · Jupyter Server

Emin63 · Published 2026-05-05 · Updated 2026-05-05 · CVE-2026-40934

Positive Technologies (AI Summary)

CVSS v4.0

7.6

High

Base vector

AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Jupyter Server versions prior to 2.18.0

Description The secret used to sign authentication cookies is persisted to a static file at ~/.local/share/jupyter/runtime/jupyter cookie secret and is not rotated when a user changes their password. Consequently, after a password reset and server restart, any previously issued authentication cookie remains cryptographically valid. An attacker who has captured a session cookie retains full authenticated access to the server regardless of subsequent password changes. This affects deployments using password-based authentication, particularly shared or public-facing servers where credential rotation is expected to revoke existing sessions.

Recommendations Update to version 2.18.0 or later. As a temporary workaround, delete the file ~/.local/share/jupyter/runtime/jupyter cookie secret and restart the server.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2026-40934

GHSA-5MRQ-X3X5-8V8F

Affected Products

Jupyter Server

References · 6

• https://osv.dev/vulnerability/GHSA-5mrq-x3x5-8v8f · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40934 · Security Note
• https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-5mrq-x3x5-8v8f · Note
• https://github.com/jupyter-server/jupyter_server · Note
• https://twitter.com/infoflowcloud/status/2051794219656699966 · Twitter Post
• https://twitter.com/CVEnew/status/2051793807692399038 · Twitter Post