Vulnerability · Published Oct 19, 2026 · Assigned by GitHub_M

CVE-2026-111058Mercury: Unauthenticated Remote Code Execution via /api/kernels

Critical 9.8

In plain English

A critical-severity missing authorization in mercury from mljar. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.5%top 55.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. Prior to 3.2.6, default tokenless deployments allow anonymous clients to create Jupyter kernels and send execute_request messages containing arbitrary Python. The endpoint blocklist does not cover /api/kernels, and the websocket wrapper previously tracked idle activity without authorizing executable messages. This issue is fixed in version 3.2.6.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	mercury	3.2.6	GHSA-rv4m-xm3f-3ccq

Affected products (as reported)

Vendor	Product	Versions
mljar	mercury	< 3.2.6

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/mljar/mercury/security/advisories/GHSA-rv4m-xm3f-3ccq x_refsource_CONFIRM
https://github.com/mljar/mercury/commit/73a40ceb0becf057f495a5738ad7f5a5222a53e1 x_refsource_MISC
https://github.com/mljar/mercury/releases/tag/3.2.6 x_refsource_MISC