CVE-2026-40110
jupyter-server CORS origin validation bypass via unanchored regex in allow_origin_pat
- State
- Published
- Severity
- 7.6 High
- Published
- May 5, 2026
- Updated
- Jul 22, 2026
- Reserved
- Apr 9, 2026
Description
Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the Origin header validation uses Python's re.match() to check incoming origins against the allow_origin_pat configuration value. Because re.match() only anchors at the start of the string and does not require a full match, a pattern intended to match only a trusted domain (e.g., trusted.example.com) will also match any origin that begins with that domain followed by additional characters (e.g., trusted.example.com.evil.com). An attacker who controls such a domain can bypass the CORS origin restriction and make cross-origin requests to the Jupyter Server API from an untrusted site. This issue has been fixed in version 2.18.0.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.6 High | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L | GitHub_M |
| 3.1 | 7.1 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N | redhat-SADP |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
jupyter_serverjupyter-server |
|
References
- https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-24qx-w28j-9m6p
- https://github.com/jupyter-server/jupyter_server/pull/603
- https://github.com/jupyter-server/jupyter_server/commit/057869a327c46730afede3eab0ca2d2e3e74acea
- https://github.com/jupyter-server/jupyter_server/commit/49b34392feaa97735b3b777e3baf8f22f2a14ed8
- https://access.redhat.com/security/cve/CVE-2026-40110vdb-entry
- RHBZ#2466912issue-tracking
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40110.json
- https://access.redhat.com/errata/RHSA-2026:43038vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.