CVE-2026-40110
Description
Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the Origin header validation uses Python's re.match() to check incoming origins against the allow_origin_pat configuration value. Because re.match() only anchors at the start of the string and does not require a full match, a pattern intended to match only a trusted domain (e.g., trusted.example.com) will also match any origin that begins with that domain followed by additional characters (e.g., trusted.example.com.evil.com). An attacker who controls such a domain can bypass the CORS origin restriction and make cross-origin requests to the Jupyter Server API from an untrusted site. This issue has been fixed in version 2.18.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
jupyter-serverPyPI | < 2.18.0 | 2.18.0 |
Affected products
6- Range: <= 2.17.0
- osv-coords4 versionspkg:apk/chainguard/datahub-ingestionpkg:apk/chainguard/datahub-ingestion-fipspkg:pypi/jupyter-serverpkg:rpm/opensuse/python-jupyter-server&distro=openSUSE%20Tumbleweed
< 1.5.0.4-r0+ 3 more
- (no CPE)range: < 1.5.0.4-r0
- (no CPE)range: < 1.5.0.1-r2
- (no CPE)range: < 2.18.0
- (no CPE)range: < 2.18.1-1.1
Patches
Vulnerability mechanics
References
6- github.com/jupyter-server/jupyter_server/commit/057869a327c46730afede3eab0ca2d2e3e74aceanvdPatchWEB
- github.com/jupyter-server/jupyter_server/commit/49b34392feaa97735b3b777e3baf8f22f2a14ed8nvdPatchWEB
- github.com/jupyter-server/jupyter_server/security/advisories/GHSA-24qx-w28j-9m6pnvdPatchVendor AdvisoryMitigationWEB
- github.com/advisories/GHSA-24qx-w28j-9m6pghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-40110ghsaADVISORY
- github.com/jupyter-server/jupyter_server/pull/603nvdIssue TrackingWEB
News mentions
0No linked articles in our index yet.