Vulnerability Description
Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the Origin header validation uses Python's re.match() to check incoming origins against the allow_origin_pat configuration value. Because re.match() only anchors at the start of the string and does not require a full match, a pattern intended to match only a trusted domain (e.g., trusted.example.com) will also match any origin that begins with that domain followed by additional characters (e.g., trusted.example.com.evil.com). An attacker who controls such a domain can bypass the CORS origin restriction and make cross-origin requests to the Jupyter Server API from an untrusted site. This issue has been fixed in version 2.18.0.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Jupyter | Jupyter Server | < 2.18.0 |
Related Weaknesses (CWE)
References
- https://github.com/jupyter-server/jupyter_server/commit/057869a327c46730afede3eaPatch
- https://github.com/jupyter-server/jupyter_server/commit/49b34392feaa97735b3b777ePatch
- https://github.com/jupyter-server/jupyter_server/pull/603Issue Tracking
- https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-24qx-wPatchVendor AdvisoryMitigation
FAQ
What is CVE-2026-40110?
CVE-2026-40110 is a vulnerability with a CVSS score of 7.3 (HIGH). Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the Origin header validation uses Python's re.match() to check incoming origins against the allow_origin_pat...
How severe is CVE-2026-40110?
CVE-2026-40110 has been rated HIGH with a CVSS base score of 7.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-40110?
Check the references section above for vendor advisories and patch information. Affected products include: Jupyter Jupyter Server.