Jupyter Server CVE-2026-114135

Requires (1) the GatewayClient.url traitlet to be configured, which swaps the normal KernelWebsocketHandler for WebSocketChannelsHandler (versions 2.0.0-2.5.x), OR (2) in 2.6.0 and later, a deployment that manually registers the deprecated jupyter_server.gateway.handlers module; and (3) a valid but restricted authenticated account whose configured Authorizer explicitly denies the 'execute' action on the 'kernels' resource. Default (non-gateway) configurations in 2.6.0+ are fixed and NOT exploitable. Limiting factors: authentication is required (PR:L, not anonymous), the vulnerable gateway mode is a non-default configuration, and the bypass is only meaningful where a deny-by-policy Authorizer is actually enforced - single-user or allow-all deployments gain nothing from it.

This is a genuine, actionable authorization-bypass (CWE-862) rather than an inflated high-CVSS score, but its real-world blast radius is gated by a non-default deployment mode. The NVD CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) is internally consistent with the description: a network-reachable, low-complexity bypass requiring only a low-privileged authenticated account (PR:L) that yields full code execution inside a kernel - hence C:H/I:H/A:H. The critical caveat is that exploitation is NOT universal across all Jupyter Server installs: it only applies when GatewayClient.url is enabled (gateway mode) in 2.0.0-2.5.x, or when a 2.6.0+ deployment manually registers the deprecated jupyter_server.gateway.handlers module. No EPSS score was provided and the CVE is not on CISA KEV, so there is no evidence of active exploitation. No weaponized POC was supplied - the only source-code evidence is the vendor fix (PR #1261 / commit 35ffe5d / release v2.6.0), which is remediation, not exploit code. Net assessment: prioritize patching for any environment running Jupyter Server in gateway mode with a multi-tenant Authorizer policy, but it is a lower priority for standard single-user or non-gateway deployments, which are unaffected.

In a multi-tenant JupyterHub/Jupyter Server deployment configured with GatewayClient.url (gateway mode), a restricted authenticated user whose Authorizer policy denies the 'execute' action opens the kernel 'channels' websocket, which is handled by WebSocketChannelsHandler. Because that handler authenticates the user but never calls authorizer.is_authorized() for the execute action, the user obtains full kernel execution and can read data and credentials accessible to the kernel. No public exploit identified at time of analysis; only the upstream fix (PR #1261) is published.