CORS Bypass in Jupyter Server by Project Jupyter

CVE-2026-6657

What is CVE-2026-6657?

A vulnerability in Jupyter Server versions 1.12.0 through 2.17.0 allows attackers to bypass CORS origin validation when the 'allow_origin_pat' configuration is used. This issue stems from utilizing 're.match()' for validating the 'Origin' header, which fails to anchor at the end of the string. As a result, attacker-controlled domains can masquerade as legitimate ones. This vulnerability affects multiple areas of the codebase, including CORS headers, WebSocket connections, referer validation, and login redirects, potentially facilitating phishing attacks, arbitrary code execution, and unauthorized access to sensitive API responses.

References