Vulnerability-Lookup

CVE-2026-114135 (GCVE-0-2026-114135)

Vulnerability from cvelistv5 – Published: 2026-10-21 19:58 – Updated: 2026-10-21 19:58

Title

Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorization

Summary

Jupyter Server is the backend for Jupyter web applications. From 2.0.0 until 2.6.0, enabling GatewayClient.url replaced the normal KernelWebsocketHandler with WebSocketChannelsHandler, which authenticated the user but did not call authorizer.is_authorized(...) for the execute action on the kernels resource. A restricted authenticated user could therefore open an upstream kernel channel and obtain kernel execution despite the configured Authorizer denying that action, exposing data and credentials available to the kernel and permitting modification or disruption of the kernel environment. The default gateway configuration is fixed in version 2.6.0. In 2.6.0 and later, the same authorization bypass remains possible when a deployment manually registers the deprecated jupyter_server.gateway.handlers module, because its handler still omits the configured kernel-execute authorization decision.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7657 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/jupyter-server/jupyter_server/…	x_refsource_CONFIRM
https://github.com/jupyter-server/jupyter_server/…	x_refsource_MISC
https://github.com/jupyter-server/jupyter_server/…	x_refsource_MISC
https://github.com/jupyter-server/jupyter_server/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
jupyter-server	jupyter_server	Affected: >= 2.0.0, < 2.6.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "jupyter_server",
          "vendor": "jupyter-server",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 2.6.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jupyter Server is the backend for Jupyter web applications. From 2.0.0 until 2.6.0, enabling GatewayClient.url replaced the normal KernelWebsocketHandler with WebSocketChannelsHandler, which authenticated the user but did not call authorizer.is_authorized(...) for the execute action on the kernels resource. A restricted authenticated user could therefore open an upstream kernel channel and obtain kernel execution despite the configured Authorizer denying that action, exposing data and credentials available to the kernel and permitting modification or disruption of the kernel environment. The default gateway configuration is fixed in version 2.6.0. In 2.6.0 and later, the same authorization bypass remains possible when a deployment manually registers the deprecated jupyter_server.gateway.handlers module, because its handler still omits the configured kernel-execute authorization decision."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T19:58:51.544Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-354v-3q48-cv69",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-354v-3q48-cv69"
        },
        {
          "name": "https://github.com/jupyter-server/jupyter_server/pull/1261",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jupyter-server/jupyter_server/pull/1261"
        },
        {
          "name": "https://github.com/jupyter-server/jupyter_server/commit/35ffe5d435682128da16dc144a8e9e9f8fa85dd8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jupyter-server/jupyter_server/commit/35ffe5d435682128da16dc144a8e9e9f8fa85dd8"
        },
        {
          "name": "https://github.com/jupyter-server/jupyter_server/releases/tag/v2.6.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jupyter-server/jupyter_server/releases/tag/v2.6.0"
        }
      ],
      "source": {
        "advisory": "GHSA-354v-3q48-cv69",
        "discovery": "UNKNOWN"
      },
      "title": "Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorization"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-114135",
    "datePublished": "2026-10-21T19:58:51.544Z",
    "dateReserved": "2026-10-20T21:53:58.473Z",
    "dateUpdated": "2026-10-21T19:58:51.544Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-114135",
      "date": "2026-10-22",
      "epss": "0.00386",
      "percentile": "0.31484"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "jupyter_server",
                "vendor": "jupyter-server",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 2.0.0, \u003c 2.6.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Jupyter Server is the backend for Jupyter web applications. From 2.0.0 until 2.6.0, enabling GatewayClient.url replaced the normal KernelWebsocketHandler with WebSocketChannelsHandler, which authenticated the user but did not call authorizer.is_authorized(...) for the execute action on the kernels resource. A restricted authenticated user could therefore open an upstream kernel channel and obtain kernel execution despite the configured Authorizer denying that action, exposing data and credentials available to the kernel and permitting modification or disruption of the kernel environment. The default gateway configuration is fixed in version 2.6.0. In 2.6.0 and later, the same authorization bypass remains possible when a deployment manually registers the deprecated jupyter_server.gateway.handlers module, because its handler still omits the configured kernel-execute authorization decision."
          }
        ],
        "id": "CVE-2026-114135",
        "lastModified": "2026-10-22T17:21:57.293",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-10-21T20:17:25.407",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/jupyter-server/jupyter_server/commit/35ffe5d435682128da16dc144a8e9e9f8fa85dd8"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/jupyter-server/jupyter_server/pull/1261"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/jupyter-server/jupyter_server/releases/tag/v2.6.0"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-354v-3q48-cv69"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-862"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-10-21T20:56:19+00:00",
      "cve": "CVE-2026-114135",
      "id": "CVE-2026-114135",
      "initial_release_date": "2026-10-21T19:58:51.544000+00:00",
      "product_status:known_affected": "20",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "jupyter-server: jupyter-server: Unauthorized code execution via missing authorization check in gateway handler",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-114135.json",
      "version": "3"
    }
  }
}

FKIE_CVE-2026-114135

Vulnerability from fkie_nvd - Published: 2026-10-21 20:17 - Updated: 2026-10-22 17:21

Severity

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/jupyter-server/jupyter_server/commit/35ffe5d435682128da16dc144a8e9e9f8fa85dd8
	security-advisories@github.com	https://github.com/jupyter-server/jupyter_server/pull/1261
	security-advisories@github.com	https://github.com/jupyter-server/jupyter_server/releases/tag/v2.6.0
	security-advisories@github.com	https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-354v-3q48-cv69

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "jupyter_server",
          "vendor": "jupyter-server",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 2.6.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Jupyter Server is the backend for Jupyter web applications. From 2.0.0 until 2.6.0, enabling GatewayClient.url replaced the normal KernelWebsocketHandler with WebSocketChannelsHandler, which authenticated the user but did not call authorizer.is_authorized(...) for the execute action on the kernels resource. A restricted authenticated user could therefore open an upstream kernel channel and obtain kernel execution despite the configured Authorizer denying that action, exposing data and credentials available to the kernel and permitting modification or disruption of the kernel environment. The default gateway configuration is fixed in version 2.6.0. In 2.6.0 and later, the same authorization bypass remains possible when a deployment manually registers the deprecated jupyter_server.gateway.handlers module, because its handler still omits the configured kernel-execute authorization decision."
    }
  ],
  "id": "CVE-2026-114135",
  "lastModified": "2026-10-22T17:21:57.293",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-10-21T20:17:25.407",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/jupyter-server/jupyter_server/commit/35ffe5d435682128da16dc144a8e9e9f8fa85dd8"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/jupyter-server/jupyter_server/pull/1261"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/jupyter-server/jupyter_server/releases/tag/v2.6.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-354v-3q48-cv69"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-354V-3Q48-CV69

Vulnerability from github – Published: 2026-10-22 15:46 – Updated: 2026-10-22 15:46

Summary

Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorization

Details

Summary

Jupyter Server's gateway WebSocket handler checks that a user is authenticated, but it does not ask the configured Authorizer whether that user may execute kernels.

In Jupyter Server 2.0.0 through 2.5.0, enabling GatewayClient.url automatically replaced the normal kernel channel handler with this gateway-specific handler. An authenticated user who is denied the execute action on the kernels resource can therefore still open a kernel channel and send messages to the upstream kernel.

Details

The normal handler performs the expected authorization check before creating the WebSocket connection:

https://github.com/jupyter-server/jupyter_server/blob/v2.5.0/jupyter_server/services/kernels/websocket.py#L39-L47

The gateway handler only checks current_user and then opens the upstream channel. It never calls authorizer.is_authorized(...):

https://github.com/jupyter-server/jupyter_server/blob/v2.5.0/jupyter_server/gateway/handlers.py#L49-L75 https://github.com/jupyter-server/jupyter_server/blob/v2.5.0/jupyter_server/gateway/handlers.py#L87-L98

Gateway mode selected that handler automatically by replacing handlers with matching routes:

https://github.com/jupyter-server/jupyter_server/blob/v2.5.0/jupyter_server/serverapp.py#L437-L446

PR #1261 stopped replacing the normal handler and routed gateway traffic through GatewayWebSocketConnection instead. This appears to have fixed the default gateway configuration in 2.6.0, although the deprecated handler is still present in current releases and can still be registered directly.

https://github.com/jupyter-server/jupyter_server/pull/1261

Code-level validation

Configure a custom Authorizer that returns false for execute on kernels for a regular authenticated user.
Configure GatewayClient.url on Jupyter Server 2.0.0-2.5.0.
The normal KernelWebsocketHandler would reject that user with 403 in pre_get.
Gateway mode replaces it with WebSocketChannelsHandler. Its authenticate method only rejects anonymous users, and get proceeds to the upstream gateway without an authorization decision.

Impact

This is a missing authorization check, not an authentication bypass. It matters in deployments that use a restrictive custom Authorizer and Jupyter Gateway/Enterprise Gateway. A read-only or otherwise limited authenticated user can cross the intended authorization boundary and obtain kernel execution, with access to data and credentials available to that kernel.

Affected versions

Default gateway configuration: 2.0.0 through 2.5.0
2.6.0 and later: the default path uses the authorized standard handler, but manually registering the deprecated jupyter_server.gateway.handlers module still exposes the old behavior.

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "jupyter-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0"
            },
            {
              "fixed": "2.6.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-114135"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-22T15:46:31Z",
    "nvd_published_at": "2026-10-21T20:17:25Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nJupyter Server\u0027s gateway WebSocket handler checks that a user is authenticated, but it does not ask the configured Authorizer whether that user may execute kernels.\n\nIn Jupyter Server 2.0.0 through 2.5.0, enabling GatewayClient.url automatically replaced the normal kernel channel handler with this gateway-specific handler. An authenticated user who is denied the `execute` action on the `kernels` resource can therefore still open a kernel channel and send messages to the upstream kernel.\n\n### Details\n\nThe normal handler performs the expected authorization check before creating the WebSocket connection:\n\nhttps://github.com/jupyter-server/jupyter_server/blob/v2.5.0/jupyter_server/services/kernels/websocket.py#L39-L47\n\nThe gateway handler only checks `current_user` and then opens the upstream channel. It never calls `authorizer.is_authorized(...)`:\n\nhttps://github.com/jupyter-server/jupyter_server/blob/v2.5.0/jupyter_server/gateway/handlers.py#L49-L75\nhttps://github.com/jupyter-server/jupyter_server/blob/v2.5.0/jupyter_server/gateway/handlers.py#L87-L98\n\nGateway mode selected that handler automatically by replacing handlers with matching routes:\n\nhttps://github.com/jupyter-server/jupyter_server/blob/v2.5.0/jupyter_server/serverapp.py#L437-L446\n\nPR #1261 stopped replacing the normal handler and routed gateway traffic through `GatewayWebSocketConnection` instead. This appears to have fixed the default gateway configuration in 2.6.0, although the deprecated handler is still present in current releases and can still be registered directly.\n\nhttps://github.com/jupyter-server/jupyter_server/pull/1261\n\n### Code-level validation\n\n1. Configure a custom Authorizer that returns false for `execute` on `kernels` for a regular authenticated user.\n2. Configure `GatewayClient.url` on Jupyter Server 2.0.0-2.5.0.\n3. The normal `KernelWebsocketHandler` would reject that user with 403 in `pre_get`.\n4. Gateway mode replaces it with `WebSocketChannelsHandler`. Its `authenticate` method only rejects anonymous users, and `get` proceeds to the upstream gateway without an authorization decision.\n\n### Impact\n\nThis is a missing authorization check, not an authentication bypass. It matters in deployments that use a restrictive custom Authorizer and Jupyter Gateway/Enterprise Gateway. A read-only or otherwise limited authenticated user can cross the intended authorization boundary and obtain kernel execution, with access to data and credentials available to that kernel.\n\n### Affected versions\n\n- Default gateway configuration: 2.0.0 through 2.5.0\n- 2.6.0 and later: the default path uses the authorized standard handler, but manually registering the deprecated `jupyter_server.gateway.handlers` module still exposes the old behavior.",
  "id": "GHSA-354v-3q48-cv69",
  "modified": "2026-10-22T15:46:31Z",
  "published": "2026-10-22T15:46:31Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-354v-3q48-cv69"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114135"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jupyter-server/jupyter_server/pull/1261"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jupyter-server/jupyter_server/commit/35ffe5d435682128da16dc144a8e9e9f8fa85dd8"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jupyter-server/jupyter_server"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jupyter-server/jupyter_server/releases/tag/v2.6.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorization"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-114135 (GCVE-0-2026-114135)

FKIE_CVE-2026-114135

GHSA-354V-3Q48-CV69

Summary

Details

Code-level validation

Impact

Affected versions

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour