Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the secret used to sign authentication cookies is persisted to a static file at ~/.local/share/jupyter/runtime/jupyter_cookie_secret and is never rotated when a user changes their password. After a password reset and server restart, any previously issued authentication cookie remains cryptographically valid because the signing key has not changed. An attacker who has captured a session cookie through any means retains full authenticated access to the server regardless of subsequent password changes. This affects deployments using password-based authentication, particularly shared or public-facing servers where credential rotation is expected to revoke existing sessions. This issue has been fixed in version 2.18.0.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-05-05 | 2 | Disclosure2 |
| 2026-05-06 | 1 | Disclosure1 |
CVE-2026-40934 Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the secret used to sign authentication cookies is persisted to a static fi… https://www.cve.org/CVERecord?id=CVE-2026-40934
Post summary
The entry announces CVE‑2026‑40934, highlighting that older Jupyter Server versions store the cookie‑signing secret in a static file, potentially enabling credential compromise.
CVE-2026-40934 Authentication Cookie Signing Key Persistence in Jupyter Server 2.17.0 and Earlier https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-40934
Post summary
The message references CVE-2026-40934 describing an authentication cookie signing key persistence issue in older Jupyter Server versions, but it provides no PoC, exploit code, active exploitation evidence, or mitigation details.
🚨*CVE* CVE-2026-40934 Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the secret used to sign authentication cookies is persisted to a static fi… https://www.cve.org/CVERecord?id=CVE-2026-40934 ----- Traducción: CVE-2026-40934 Jup… http://infoflow.cloud`
Post summary
The post announces CVE‑2026‑40934, noting that Jupyter Server keeps the cookie‑signing secret in a static file, but there is no evidence of exploits, patches, or active usage.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | jupyter | jupyter_server | - | - | - |