Jupyter Server CVE-2026-40110

Requires Jupyter Server <= 2.17.0 deployed with the allow_origin_pat configuration option explicitly set (this is NOT a default configuration - most Jupyter deployments do not enable CORS origin patterns). The attacker must control a domain name that begins with the trusted pattern followed by additional characters, requiring either domain registration or DNS compromise. Exploitation occurs when an authenticated user with an active Jupyter session visits the attacker-controlled domain in their browser, allowing cross-origin JavaScript execution. The vulnerability does NOT affect default Jupyter Server installations where allow_origin_pat is unset or where allow_origin (exact string matching) is used instead. Network access to the victim's Jupyter Server is required (typically HTTP/HTTPS on ports 8888 or custom), but can be from any origin due to the CORS bypass. No special user interaction beyond visiting a malicious website is needed once the session exists.

Real-world risk is MODERATE despite the absence of CVSS scoring. The vulnerability requires specific deployment conditions: Jupyter Server must be configured with allow_origin_pat (not default behavior for most installations), and the attacker must control or register a domain matching the trusted prefix plus arbitrary suffix. Attack complexity is LOW once conditions are met - no authentication required, purely client-side exploitation via crafted Origin headers. The technical impact is information disclosure (accessing notebook contents, execution history, or API responses) rather than direct code execution, limiting immediate severity. EPSS and KEV data are unavailable, suggesting no widespread exploitation campaigns. However, Jupyter notebooks often contain sensitive research data, credentials, and API keys, making unauthorized access significant for targeted attacks against research institutions or data science teams. The availability of a clean patch (2.18.0) and simple workaround (regex anchoring) reduces residual risk for organizations that can deploy updates. Priority should be MEDIUM for environments using custom CORS configurations, LOW for default deployments where allow_origin_pat is not configured.

An attacker identifies a target organization running Jupyter Server 2.17.0 configured with allow_origin_pat set to 'research\.university\.edu' to permit the institution's web portal to access notebook APIs. The attacker registers the domain 'research.university.edu.malicious-analytics.com' and hosts a web application there. When a researcher with an active Jupyter session visits the attacker's site, JavaScript code sends cross-origin API requests to the victim's Jupyter Server with Origin header 'http://research.university.edu.malicious-analytics.com'. The flawed re.match() validation sees the string starts with 'research.university.edu' and incorrectly approves the request, allowing the attacker's JavaScript to exfiltrate notebook contents, execute arbitrary code in the notebook kernel, or extract authentication tokens. No public POC is confirmed, but exploitation requires only basic web development skills and domain registration.