Vulnerability · Published May 5, 2026 · Assigned by GitHub_M
CVE-2026-40110jupyter-server CORS origin validation bypass via unanchored regex in allow_origin_pat
High 7.1
In plain English
A high-severity security flaw in jupyter_server from jupyter-server. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the Origin header validation uses Python's re.match() to check incoming origins against the allow_origin_pat configuration value. Because re.match() only anchors at the start of the string and does not require a full match, a pattern intended to match only a trusted domain (e.g., trusted.example.com) will also match any origin that begins with that domain followed by additional characters (e.g., trusted.example.com.evil.com). An attacker who controls such a domain can bypass the CORS origin restriction and make cross-origin requests to the Jupyter Server API from an untrusted site. This issue has been fixed in version 2.18.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.24 | jupyter-server | 2.18.2-r0 | ALPINE-CVE-2026-40110 |
| Debian:12 | jupyter-server | no fix listed | DEBIAN-CVE-2026-40110 |
| Debian:13 | jupyter-server | no fix listed | DEBIAN-CVE-2026-40110 |
| Debian:14 | jupyter-server | 2.20.0-1 | DEBIAN-CVE-2026-40110 |
| PyPI | jupyter-server | 2.18.0 | PYSEC-2026-2187 |
| PyPI | jupyter-server | 2.18.0 | GHSA-24qx-w28j-9m6p |
| Ubuntu:22.04:LTS | jupyter-server | no fix listed | UBUNTU-CVE-2026-40110 |
| Ubuntu:24.04:LTS | jupyter-server | no fix listed | UBUNTU-CVE-2026-40110 |
| Ubuntu:25.10 | jupyter-server | no fix listed | UBUNTU-CVE-2026-40110 |
| Ubuntu:26.04:LTS | jupyter-server | no fix listed | UBUNTU-CVE-2026-40110 |
| Ubuntu:26.10 | jupyter-server | no fix listed | UBUNTU-CVE-2026-40110 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| jupyter-server | jupyter_server | <= 2.17.0 |
Weakness: CWE-777, CWE-625 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
References
- https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-24qx-w28j-9m6p x_refsource_CONFIRM
- https://github.com/jupyter-server/jupyter_server/pull/603 x_refsource_MISC
- https://github.com/jupyter-server/jupyter_server/commit/057869a327c46730afede3eab0ca2d2e3e74acea x_refsource_MISC
- https://github.com/jupyter-server/jupyter_server/commit/49b34392feaa97735b3b777e3baf8f22f2a14ed8 x_refsource_MISC
- https://access.redhat.com/security/cve/CVE-2026-40110 vdb-entry, x_refsource_REDHAT
- RHBZ#2466912 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40110.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:43038 vendor-advisory, x_refsource_REDHAT