CVE-2026-6657 Details
Description
A vulnerability in jupyter-server versions 1.12.0 through 2.17.0 allows an attacker to bypass CORS origin validation when the `allow_origin_pat` configuration is used. The issue arises from the use of `re.match()` for validating the `Origin` header, which only anchors at the start of the string. This allows attacker-controlled domains such as `trusted.example.com.evil.com` to pass validation against patterns intended to match `trusted.example.com`. The vulnerability affects multiple locations in the codebase, including CORS headers, WebSocket connections, referer validation, and login redirects, potentially enabling phishing attacks, arbitrary code execution, and unauthorized access to sensitive API responses.
A vulnerability exists in Jupyter Server versions 1.12.0 through 2.17.0, allowing attackers to bypass Cross-Origin Resource Sharing (CORS) origin validation when the 'allow_origin_pat' configuration is applied. The issue stems from using 're.match()' for validating the 'Origin' header, which only checks the beginning of the string. This flaw enables domains controlled by attackers, such as 'trusted.example.com.evil.com', to be mistakenly validated as legitimate. The vulnerability impacts several areas, including CORS headers, WebSocket connections, referer validation, and login redirects, potentially leading to phishing attacks, arbitrary code execution, and unauthorized access to sensitive API responses.
Users should update to a version of Jupyter Server that addresses this vulnerability. The suggested fix is to replace 're.match()' with 're.fullmatch()' in the relevant code locations. Users who relied on the prefix-matching behavior should append '.*' to their patterns.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://huntr.com/bounties/18f642db-3569-43b3-b58d-ff97be4b09d7 | CISA-ADP | ExploitThird Party Advisory |
| https://huntr.com/bounties/18f642db-3569-43b3-b58d-ff97be4b09d7 | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-346 | Origin Validation Error | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| jupyter jupyter server | >= 1.12.0, <= 2.17.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | CVE Translated | [email protected] |
| Jun 30, 2026 | Initial Analysis | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 3, 2026 | CVE Modified | CISA-ADP |
| Jun 3, 2026 | New CVE Received | [email protected] |