CVE-2026-73627
Received Received - Intake

JupyterLab Plugin Manager Lock-Rule Bypass Vulnerability

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: VulnCheck

Description
JupyterLab (pip package 'jupyterlab') versions >=4.1.0,<=4.5.9 and >=4.6.0,<=4.6.1 contain a plugin manager lock-rule enforcement bypass. Two server-side enforcement gaps allow an authenticated user to circumvent administrator lock rules by making direct requests to the /lab/api/plugins endpoint, enabling or disabling plugins that were locked — including child plugins of multi-plugin extensions and plugins locked via the 'lock all' mechanism. This can impact data integrity and bypass hardening or restrictions (e.g., download/upload limits) implemented through locked plugins. Fixed in versions 4.6.2 and 4.5.10.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-73627
EUVD
EUVD-2026-57796

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
jupyterlab jupyterlab From 4.1.0 (inc) to 4.5.9 (inc)
jupyterlab jupyterlab From 4.6.0 (inc) to 4.6.1 (inc)
jupyterlab jupyterlab 4.6.2
jupyterlab jupyterlab 4.5.10

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-602 The product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-73627 is a vulnerability in JupyterLab's PluginManager that allows an authenticated user to bypass administrator-imposed plugin lock rules. The issue stems from two server-side enforcement gaps in the /lab/api/plugins endpoint, enabling users to enable or disable locked plugins directly via API requests. This affects versions 4.6.0 to 4.6.1 and 4.1.0 to 4.5.9.

Detection Guidance

Check JupyterLab version with: pip show jupyterlab. If version is >=4.1.0 and <=4.5.9 or >=4.6.0 and <=4.6.1, the system is vulnerable. Monitor /lab/api/plugins endpoint access logs for unauthorized API requests.

Impact Analysis

This vulnerability can allow an authenticated user to circumvent data integrity protections, download/upload limits, or other plugin-based restrictions. It may also enable bypassing hardening measures implemented through locked plugins, potentially compromising system security and functionality.

Mitigation Strategies

Upgrade JupyterLab to version 4.6.2 or 4.5.10 immediately. Alternatively, manually lock all relevant plugins individually as a temporary workaround.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73627. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart