VulnSocial

CVE-2026-111058

LOWCVSS 9.8 · CRITICAL

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. Prior to 3.2.6, default tokenless deployments allow anonymous clients to create Jupyter kernels and send execute_request messages containing arbitrary Python. The endpoint blocklist does not cover /api/kernels, and the websocket wrapper previously tracked idle activity without authorizing executable messages. This issue is fixed in version 3.2.6.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-862

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 2 mentions across 1 observed day

What's happening

  • 2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-10-19: 210-19
Referenced assets1 URL
Full discourse2 posts
  • The Hacker Wire@TheHackerWire

    🚨 CVE-2026-111057 (CVSS 10.0 Critical) A missing comma in Mercury concatenated regexes, exposing /api/terminals and giving unauthenticated attackers interactive OS shells. ⚡ Action: Upgrade to >= v3.2.4 immediately (fixes CVE-2026-111058 too). https://t.co/lP6mRIUJPk

    1000080
    190 followersView on X
  • Severity Daily@severitydaily

    A missing comma in Mercury's blocklist merged two regex patterns, leaving /api/terminals and /lab open to unauthenticated shells. Scored 10.0. No exploitation reported. https://severitydaily.com/mercury-cve-2026-111057-missing-comma-blocked-patterns-10-0-cve-2026-111058-3-2-6-no-change/

    0000033
    33 followersView on X

Explore more

Back to dashboard