CVE-2026-40110
High · 7.3CVSS
7.3
EPSS
0.5%
Published
May 5, 2026
CISA due date
—
The record
Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the Origin header validation uses Python's re.match() to check incoming origins against the allow_origin_pat configuration value. Because re.match() only anchors at the start of the string and does not require a full match, a pattern intended to match only a trusted domain (e.g., trusted.example.com) will also match any origin that begins with that domain followed by additional characters (e.g., trusted.example.com.evil.com). An attacker who controls such a domain can bypass the CORS origin restriction and make cross-origin requests to the Jupyter Server API from an untrusted site. This issue has been fixed in version 2.18.0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | python-jupyter-server | 0 | 2.18.1-1.1 |
Related vulnerabilities
- CVE-2026-44727 Jupyter Server is the backend for Jupyter web applications. Also affects python-jupyter-server
- CVE-2026-5422 A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an… Also affects python-jupyter-server
- CVE-2026-40934 Jupyter Server is the backend for Jupyter web applications. Also affects python-jupyter-server
- CVE-2026-35397 Jupyter Server is the backend for Jupyter web applications. Also affects python-jupyter-server
- CVE-2025-61669 Jupyter Server is the backend for Jupyter web applications. Also affects python-jupyter-server
- CVE-2026-56021 Webmin allows unauthenticated attackers to read the contents of any file ending in .conf… CWE-777
- CVE-2026-39087 ntfy before 2.22.0 allows SSRF because of an unanchored regular expression for web push… CWE-777