CVE-2026-40110
Origin Header Bypass in Jupyter Server
Publication date: 2026-05-05
Last updated on: 2026-05-05
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| jupyter | jupyter_server | to 2.18.0 (exc) |
| jupyter | jupyter_server | 2.18.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-777 | The product uses a regular expression to perform neutralization, but the regular expression is not anchored and may allow malicious or malformed data to slip through. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Jupyter Server versions 2.17.0 and earlier. It involves improper validation of the Origin header used in Cross-Origin Resource Sharing (CORS) checks. The server uses Python's re.match() function to validate incoming origins against a configured pattern. However, re.match() only checks the start of the string and does not require a full match, allowing an attacker controlling a domain that begins with a trusted domain name but has additional characters (e.g., trusted.example.com.evil.com) to bypass the origin restriction.
As a result, an attacker can make cross-origin requests to the Jupyter Server API from an untrusted site, potentially accessing or manipulating data they should not have access to. This issue was fixed in version 2.18.0.
How can this vulnerability impact me? :
This vulnerability can allow attackers to bypass CORS origin restrictions and perform unauthorized cross-origin requests to the Jupyter Server API. This could lead to unauthorized access to sensitive data or actions within the Jupyter Server environment from malicious websites.
Such unauthorized access could compromise the confidentiality and integrity of data, potentially leading to data leakage, unauthorized code execution, or manipulation of user sessions.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade Jupyter Server to version 2.18.0 or later, where the issue with Origin header validation has been fixed.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves improper validation of the Origin header in Jupyter Server versions 2.17.0 and earlier, allowing bypass of CORS origin restrictions.
To detect if your system is vulnerable, first verify the version of Jupyter Server running on your system. Versions 2.17.0 and earlier are affected.
You can check the Jupyter Server version by running the following command:
- jupyter server --version
To detect potential exploitation attempts on your network, monitor HTTP requests to the Jupyter Server API for suspicious Origin headers that start with a trusted domain but include additional characters (e.g., trusted.example.com.evil.com).
You can use network monitoring tools like tcpdump or Wireshark to capture traffic and filter for such Origin headers.
Example tcpdump command to capture HTTP traffic on port 8888 (default Jupyter Server port):
- sudo tcpdump -A -s 0 'tcp port 8888 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'
Then, inspect the captured packets for suspicious Origin headers.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows an attacker to bypass CORS origin restrictions by exploiting improper Origin header validation in Jupyter Server versions 2.17.0 and earlier. Such a bypass can enable unauthorized cross-origin requests to the Jupyter Server API from untrusted sites.
By permitting unauthorized access, this vulnerability could potentially lead to exposure or unauthorized manipulation of sensitive data handled by the Jupyter Server. This exposure may impact compliance with data protection regulations such as GDPR or HIPAA, which require strict controls on data access and protection against unauthorized disclosure.
Therefore, organizations using affected versions of Jupyter Server might face increased risk of non-compliance with these standards until the vulnerability is remediated by upgrading to version 2.18.0 or later.