CVE-2026-40110 Details
Description
Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the Origin header validation uses Python's re.match() to check incoming origins against the allow_origin_pat configuration value. Because re.match() only anchors at the start of the string and does not require a full match, a pattern intended to match only a trusted domain (e.g., trusted.example.com) will also match any origin that begins with that domain followed by additional characters (e.g., trusted.example.com.evil.com). An attacker who controls such a domain can bypass the CORS origin restriction and make cross-origin requests to the Jupyter Server API from an untrusted site. This issue has been fixed in version 2.18.0.
A vulnerability in Jupyter Server in versions through 2.17.0 allows for CORS origin validation bypass. The issue arises because the `allow_origin_pat` configuration is evaluated using Python's `re.match()`, which only anchors at the start of the string. This behavior can be exploited by an attacker controlling a domain that prefixes a trusted origin, bypassing CORS restrictions and enabling cross-origin requests to the Jupyter Server API from untrusted sites.
Users can update to Jupyter Server version 2.18.0 or later, where this vulnerability has been fixed. Additionally, review and adjust the `allow_origin_pat` configuration to ensure it does not rely on prefix matching.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-625 | Permissive Regular Expression | redhat-SADP |
| CWE-777 | Regular Expression without Anchors | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| jupyter jupyter server | < 2.18.0 |
CPE
Remediation
| |
Change History
8 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jul 22, 2026 | CVE Modified | redhat-SADP |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| May 11, 2026 | Initial Analysis | [email protected] |
| May 5, 2026 | New CVE Received | [email protected] |