Vulnerability · Published May 5, 2026 · Assigned by GitHub_M
CVE-2026-40934jupyter-server authentication cookies remain valid after password reset due to static cookie secret
High 7.6
In plain English
A high-severity security flaw in jupyter_server from jupyter-server. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the secret used to sign authentication cookies is persisted to a static file at ~/.local/share/jupyter/runtime/jupyter_cookie_secret and is never rotated when a user changes their password. After a password reset and server restart, any previously issued authentication cookie remains cryptographically valid because the signing key has not changed. An attacker who has captured a session cookie through any means retains full authenticated access to the server regardless of subsequent password changes. This affects deployments using password-based authentication, particularly shared or public-facing servers where credential rotation is expected to revoke existing sessions. This issue has been fixed in version 2.18.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.24 | jupyter-server | 2.18.2-r0 | ALPINE-CVE-2026-40934 |
| Debian:12 | jupyter-server | no fix listed | DEBIAN-CVE-2026-40934 |
| Debian:13 | jupyter-server | no fix listed | DEBIAN-CVE-2026-40934 |
| Debian:14 | jupyter-server | 2.20.0-1 | DEBIAN-CVE-2026-40934 |
| PyPI | jupyter-server | 2.18.0 | PYSEC-2026-69 |
| PyPI | jupyter-server | 2.18.0 | GHSA-5mrq-x3x5-8v8f |
| Ubuntu:22.04:LTS | jupyter-server | no fix listed | UBUNTU-CVE-2026-40934 |
| Ubuntu:24.04:LTS | jupyter-server | no fix listed | UBUNTU-CVE-2026-40934 |
| Ubuntu:25.10 | jupyter-server | no fix listed | UBUNTU-CVE-2026-40934 |
| Ubuntu:26.04:LTS | jupyter-server | no fix listed | UBUNTU-CVE-2026-40934 |
| Ubuntu:26.10 | jupyter-server | no fix listed | UBUNTU-CVE-2026-40934 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| jupyter-server | jupyter_server | < 2.18.0 |
Weakness: CWE-613 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N