GitHub Advisoryadvisory · PyPI

GHSA-24qx-w28j-9m6p Jupyter Server has a CORS Origin Validation Bypass via `re.match()` in `allow_origin_pat`

HIGH Published 2026-05-05 Modified 2026-07-31 Official page ↗
Aliases
CVE-2026-40110
Ecosystem
PyPI
Packages
jupyter-server
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L
Weaknesses
CWE-625, CWE-777
Reviewed
2026-05-05

Affected packages

• PyPI jupyter-server: < 2.18.0 → fixed in 2.18.0

Description

Jupyter Server uses `re.match()` to validate the Origin header against the `allow_origin_pat` configuration. Since `re.match()` only anchors at the start of the string, an attacker who controls a domain like `http://trusted.example.com.evil.com/` passes validation against a pattern intended to match only `trusted.example.com`. Impact <=2.17.0 Patches 057869a327c46730afede3eab0ca2d2e3e74acea, 49b34392feaa97735b3b777e3baf8f22f2a14ed8 Workarounds Wrap your `allow_origin_pat` value with `^` and `$` References https://github.com/jupyter-server/jupyter_server/pull/603 https://docs.python.org/3/library/re.html#re.fullmatch https://docs.python.org/3/library/re.html#re.match

Related

Alias · CVE (1)

  • CVE-2026-40110 Jupyter Server is the backend for Jupyter web applications. vulnerability

Weakness · CWE (2)

  • CWE-625 Permissive Regular Expression weakness
  • CWE-777 Regular Expression without Anchors weakness

References