Vulnerability · Published Aug 13, 2026 · Assigned by VulnCheck

CVE-2026-73627JupyterLab 4.6.0 Plugin Manager Lock-Rule Enforcement Bypass

Medium 6.0

In plain English

A medium-severity security flaw in jupyterlab from jupyterlab. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.0Medium

Exploit odds (30 days)0.4%top 63.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

JupyterLab (pip package 'jupyterlab') versions >=4.1.0,<=4.5.9 and >=4.6.0,<=4.6.1 contain a plugin manager lock-rule enforcement bypass. Two server-side enforcement gaps allow an authenticated user to circumvent administrator lock rules by making direct requests to the /lab/api/plugins endpoint, enabling or disabling plugins that were locked — including child plugins of multi-plugin extensions and plugins locked via the 'lock all' mechanism. This can impact data integrity and bypass hardening or restrictions (e.g., download/upload limits) implemented through locked plugins. Fixed in versions 4.6.2 and 4.5.10.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:13	jupyterlab	no fix listed	DEBIAN-CVE-2026-73627
Debian:14	jupyterlab	4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-4	DEBIAN-CVE-2026-73627
PyPI	jupyterlab	4.6.2	GHSA-h5v5-8746-g7mm
PyPI	jupyterlab	4.5.10	GHSA-h5v5-8746-g7mm
Ubuntu:26.04:LTS	jupyterlab	no fix listed	UBUNTU-CVE-2026-73627
Ubuntu:26.10	jupyterlab	no fix listed	UBUNTU-CVE-2026-73627

Affected products (as reported)

Vendor	Product	Versions
jupyterlab	jupyterlab	4.6.0 – through 4.6.1
jupyterlab	jupyterlab	4.1.0 – through 4.5.9

Weakness: CWE-602 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

References

GitHub Security Advisory (GHSA-h5v5-8746-g7mm) vendor-advisory
VulnCheck Advisory: JupyterLab 4.6.0 Plugin Manager Lock-Rule Enforcement Bypass third-party-advisory