Skip to main content

JupyterLab EUVDEUVD-2026-57796

| CVE-2026-73627 MEDIUM
Client-Side Enforcement of Server-Side Security (CWE-602)
2026-08-13 VulnCheck GHSA-fpf6-h6p9-9rjr
Authentication Bypass Jupyterlab Red Hat Suse
6.0
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
6.0 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.1 HIGH

Network vector confirmed by direct API access; PR:L reflects required authentication; S:U as impact is confined to the single-user server session; I:H reflects bypass of administrative plugin controls.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
7.1 HIGH
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

2
Source Code Evidence Fetched
Aug 13, 2026 - 12:36 vuln.today
Analysis Generated
Aug 13, 2026 - 12:36 vuln.today

DescriptionCVE.org

JupyterLab (pip package 'jupyterlab') versions >=4.1.0,<=4.5.9 and >=4.6.0,<=4.6.1 contain a plugin manager lock-rule enforcement bypass. Two server-side enforcement gaps allow an authenticated user to circumvent administrator lock rules by making direct requests to the /lab/api/plugins endpoint, enabling or disabling plugins that were locked - including child plugins of multi-plugin extensions and plugins locked via the 'lock all' mechanism. This can impact data integrity and bypass hardening or restrictions (e.g., download/upload limits) implemented through locked plugins. Fixed in versions 4.6.2 and 4.5.10.

AnalysisAI

Plugin lock-rule enforcement bypass in JupyterLab (pip package, versions >=4.1.0,<=4.5.9 and >=4.6.0,<=4.6.1) allows authenticated users to subvert administrator-configured plugin restrictions by sending direct requests to the /lab/api/plugins endpoint. Two distinct server-side enforcement gaps expose child plugins of multi-plugin extensions and plugins locked via the 'lock all' mechanism to unauthorized enable/disable operations, undermining data integrity controls and security restrictions - such as download/upload limits - implemented through locked plugins. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Authenticate to JupyterLab server with valid credentials
Delivery
Identify target locked plugin identifier via Plugin Manager UI or documentation
Exploit
Craft direct HTTP request to /lab/api/plugins endpoint
Execution
Submit request bypassing server-side lock enforcement
Persist
Enable or disable administrator-restricted plugin
Impact
Circumvent security controls implemented through that plugin
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a valid authenticated session on the JupyterLab server (PR:L confirmed by CVSS vector). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 6.0 with vector AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N reflects a medium-severity issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An authenticated user on a shared JupyterHub server, aware of the /lab/api/plugins endpoint, sends a direct HTTP POST request to enable a file-download plugin that the administrator locked to enforce a data retention policy. With the plugin re-enabled within their session, the user can download restricted datasets, bypassing the intended organizational control. …
Remediation Vendor-released patch: upgrade the jupyterlab pip package to 4.6.2 (for 4.6.x deployments) or 4.5.10 (for 4.5.x deployments), both of which contain the server-side enforcement fix per the GHSA advisory. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Jupyterlab

View all
CVE-2024-39700 CRITICAL POC
9.8 Jul 16

JupyterLab extension template is a `copier` template for JupyterLab extensions. Rated critical severity (CVSS 9.8), this
CVE-2021-32797 CRITICAL POC
9.6 Aug 09

JupyterLab is a user interface for Project Jupyter which will eventually replace the classic Jupyter Notebook. Rated cri
CVE-2024-22421 MEDIUM
6.5 Jan 19

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Ar
CVE-2024-43805 MEDIUM
6.1 Aug 28

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Archit
CVE-2024-22420 MEDIUM
6.1 Jan 19

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Ar
CVE-2026-67338 MEDIUM
5.1 Aug 01

Stored cross-site scripting in JupyterLab's Extension Manager allows an attacker who publishes a malicious PyPI package

CVE-2026-73626 NONE
Aug 13

Allowlist/blocklist bypass in JupyterLab's PyPIExtensionManager.install() allows unauthorized pip packages to be install
CVE-2025-59842 LOW
2.1 Sep 26

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Archit

Same weakness CWE-602 – Client-Side Enforcement of Server-Side Security

View all
CVE-2025-51682 CRITICAL POC
9.8
CVE-2025-32808 HIGH POC
7.7
CVE-2020-8162 HIGH POC
7.5
CVE-2022-3308 HIGH POC
7.4
CVE-2023-42787 MEDIUM POC
6.5
CVE-2026-30521 MEDIUM POC
6.5
CVE-2026-30522 MEDIUM POC
6.5
CVE-2022-3310 MEDIUM POC
6.5

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Vendor StatusVendor

SUSE

Severity: Moderate

Share

EUVD-2026-57796 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy