Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the Origin header validation uses Python's re.match() to check incoming origins against the allow_origin_pat configuration value. Because re.match() only anchors at the start of the string and does not require a full match, a pattern intended to match only a trusted domain (e.g., trusted.example.com) will also match any origin that begins with that domain followed by additional characters (e.g., trusted.example.com.evil.com). An attacker who controls such a domain can bypass the CORS origin restriction and make cross-origin requests to the Jupyter Server API from an untrusted site. This issue has been fixed in version 2.18.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🚨 High - Jupyter Server access bypass (CVE-2026-40110, CVE-2026-35397) jupyter-server has two validation flaws: CORS Origin bypass via re.match() and path traversal via incorrect startswith() root checks. 👉 Affects <= 2.17.0 👉 Update to 2.18.0 immediately
Post summary
High severity CVEs for Jupyter Server with disallowed access bypass and path traversal, patched by upgrading to 2.18.0.
🚨*CVE* CVE-2026-40110 Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the Origin header validation uses Python's re.match() to check incoming or… https://www.cve.org/CVERecord?id=CVE-2026-40110 ----- Traducción: CVE-2026-40110 Jup… http://infoflow.cloud`
Post summary
The text introduces CVE‑2026‑40110, indicating a flaw in Origin header validation in Jupyter Server and providing a link to the CVE record. It serves as a disclosure of the vulnerability details without reporting exploitation, patches, or PoC material.
CVE-2026-40110 Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the Origin header validation uses Python's re.match() to check incoming or… https://www.cve.org/CVERecord?id=CVE-2026-40110
Post summary
The text announces CVE-2026-40110, describing a flaw in Jupyter Server’s Origin header validation that relies on Python’s re.match(), but provides no PoC, exploitation, patch, or active‑use information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | jupyter | jupyter_server | - | - | - |