Authorization Bypass in Jupyter Server Affects Users

CVE-2026-114135

What is CVE-2026-114135?

Jupyter Server, a key component for Jupyter web applications, contains a vulnerability that allows restricted authenticated users to bypass authorization checks. In versions from 2.0.0 to 2.6.0, enabling GatewayClient.url inadvertently switches the normal handler to WebSocketChannelsHandler, which validates users but fails to enforce proper authorization for executing actions on kernels. This oversight could permit unauthorized users to open an upstream kernel channel, gaining access to sensitive data and credentials while potentially disrupting the kernel environment. Even after updating to version 2.6.0, if deployments manually register the deprecated jupyter_server.gateway.handlers module, the same authorization bypass could still occur, highlighting the importance of ensuring all aspects of authorization are correctly configured.

References