jupyter-server jupyter_server up to 2.17.0 Jupyter Server API re.match regular expression without anchors

Summaryinfo

A vulnerability marked as critical has been reported in jupyter-server jupyter_server up to 2.17.0. This affects the function re.match of the component Jupyter Server API. The manipulation leads to regular expression without anchors. This vulnerability is listed as CVE-2026-40110. The attack may be initiated remotely. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in jupyter-server jupyter_server up to 2.17.0. This issue affects the function re.match of the component Jupyter Server API. The manipulation with an unknown input leads to a regular expression without anchors vulnerability. Using CWE to declare the problem leads to CWE-777. The product uses a regular expression to perform neutralization, but the regular expression is not anchored and may allow malicious or malformed data to slip through. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the Origin header validation uses Python's re.match() to check incoming origins against the allow_origin_pat configuration value. Because re.match() only anchors at the start of the string and does not require a full match, a pattern intended to match only a trusted domain (e.g., trusted.example.com) will also match any origin that begins with that domain followed by additional characters (e.g., trusted.example.com.evil.com). An attacker who controls such a domain can bypass the CORS origin restriction and make cross-origin requests to the Jupyter Server API from an untrusted site. This issue has been fixed in version 2.18.0.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-40110 since 04/09/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available.

Upgrading to version 2.18.0 eliminates this vulnerability. Applying the patch 057869a327c46730afede3eab0ca2d2e3e74acea is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-27510). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• jupyter-server

Name

• jupyter_server

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9
• 2.10
• 2.11
• 2.12
• 2.13
• 2.14
• 2.15
• 2.16
• 2.17.0

License

• open-source

Website

• Product: https://github.com/jupyter-server/jupyter_server/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion