LiveActive security incident?Get immediate response
CVE Record

CVE-2026-40110: jupyter-server CORS origin validation bypass via unanchored regex in allow_origin_pat

Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the Origin header validation uses Python's re.match() to check incoming origins against the allow_origin_pat configuration value. Because re.match() only anchors at the start of the string and does not require a full match, a pattern intended to match only a trusted domain (e.g., trusted.example.com) will also match any origin that begins with that domain followed by additional characters (e.g., trusted.example.com.evil.com). An attacker who controls such a domain can bypass the CORS origin restriction and make cross-origin requests to the Jupyter Server API from an untrusted site. This issue has been fixed in version 2.18.0.

HighCVSS 7.6Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2026-40110 lets a malicious website appear trusted to some Jupyter Server deployments because origin checking accepts regex prefix matches. If a user visits an attacker-controlled site, that site may be able to make browser-based API requests to the Jupyter Server as though it were an allowed origin.

Executive priority

Treat as high priority for environments using Jupyter Server with cross-origin access controls. The issue can undermine browser trust boundaries around sensitive notebooks, data, or API actions, but evidence provided does not establish active exploitation.

Technical view

Jupyter Server 2.17.0 and earlier validate the Origin header against allow_origin_pat using Python re.match(). Because the match is not required to cover the full origin, attacker-controlled lookalike origins that start with a trusted value can bypass intended CORS restrictions. The issue is fixed in 2.18.0.

Likely exposure

Exposure is most likely where Jupyter Server <=2.17.0 is reachable by users' browsers and allow_origin_pat is configured for trusted domains without fully anchored patterns.

Exploitation context

The bundle does not show KEV listing or active exploitation. Exploitation requires user interaction and a deployment whose CORS trust pattern can be prefix-matched by an attacker-controlled origin.

Researcher notes

Focus validation on CORS behavior and configuration state, not just package presence. The vulnerable condition depends on allow_origin_pat semantics and regex construction. Avoid assuming all Jupyter Server deployments are exploitable without confirming affected version, configuration, reachability, and user-interaction path.

Mitigation direction

  • Upgrade Jupyter Server to version 2.18.0 or later.
  • Review allow_origin_pat values for exact anchoring and overly broad regex patterns.
  • Limit browser access to Jupyter Server through trusted networks or access controls.
  • Check vendor advisories for distribution-specific fixed packages, including Red Hat guidance.

Validation and detection

  • Inventory Jupyter Server versions and flag deployments at 2.17.0 or earlier.
  • Identify systems using allow_origin_pat and review their configured origin regexes.
  • Confirm upgraded systems report Jupyter Server 2.18.0 or later.
  • Review access logs for unexpected cross-origin API requests from lookalike domains.
Prepared
Confidence
high
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-625: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cwe · low confidence lookup

CWE-777: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-40110 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.6 (4.0)
Known Exploited
No
Published

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

2CVSS vectors
5Timeline events
2ADP providers
9Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: total

CVSS vector scores

2 official scores

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.6CVSS 4.0HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L——GitHub_M
7.1CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N2.84.2redhat-SADP

Vulnerability scoring details

Base CVSS 4.0 score

7.6High
CVSS 4.0 vector shape for CVE-2026-40110Attack VectorAttack ComplexityAttack RequirementsPrivileges RequiredUser InteractionVS ConfidentialityVS IntegrityVS AvailabilitySS ConfidentialitySS IntegritySS Availability

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Attack Requirements
NonePresent
Privileges Required
NoneLowHigh
User Interaction
NonePassiveActive
VS Confidentiality
HighLowNone
VS Integrity
HighLowNone
VS Availability
HighLowNone
SS Confidentiality
HighLowNone
SS Integrity
HighLowNone
SS Availability
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. ADP timelineredhat-SADP

    Made public.

  3. CVE publishedCVE Program

    The CVE record was published.

  4. ADP timelineredhat-SADP

    Reported to Red Hat.

  5. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
redhat-SADPjupyter-server: Jupyter Server: Cross-Origin Resource Sharing (CORS) bypass via improper Origin header validation
other:Red Hat severity ratingcvssV3_1
  • 2026-05-05T22:01:09.643Z: Reported to Red Hat.
  • 2026-05-05T21:29:31.323Z: Made public.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
jupyter-serverjupyter_server<= 2.17.0Listed
Weakness

CWE details

CWE-625CWE-777

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-625 · source CWE mapping

Permissive Regular Expression

Permissive Regular Expression represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs
CWE-777 · source CWE mapping

Regular Expression without Anchors

Regular Expression without Anchors represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs