Tokenless Deployment Vulnerability in Mercury Framework by MLJAR
CVE-2026-111058

9.8CRITICAL

Key Information:

Vendor

Mljar

Status
Mercury
Vendor
CVE Published:
19 October 2026

What is CVE-2026-111058?

The Mercury framework, which facilitates sharing Jupyter notebooks as web applications, possesses a security flaw that exposes it to exploitation through tokenless deployments. These deployments permit unauthorized clients to create Jupyter kernels and issue execute_request messages that can execute arbitrary Python code on the server. Notably, the endpoint blocklist fails to adequately secure the /api/kernels endpoint, and the websocket wrapper inadequately tracks idle activity without proper authorization for executable messages. This vulnerability has been resolved in version 3.2.6.

Affected Version(s)

mercury < 3.2.6

References

https://github.com/mljar/mercury/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/mljar/mercury/commit/73a40ceb0becf057f...
x_refsource_MISC
https://github.com/mljar/mercury/releases/tag/3.2.6
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.