Read the docs
TI-2026-76430 Aliases CVE-2026-111058GHSA-rv4m-xm3f-3ccq

Mercury lets anonymous clients execute arbitrary Python code

Priority MEDIUM 49CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-862.

Summary

Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. Versions before 3.2.6 allow anonymous clients on default tokenless deployments to create Jupyter kernels, because the endpoint blocklist does not cover /api/kernels and the websocket wrapper does not authorize executable messages (CWE-862). An unauthenticated remote attacker can send messages that run arbitrary Python code.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. Prior to 3.2.6, default tokenless deployments allow anonymous clients to create Jupyter kernels and send execute_request messages containing arbitrary Python. The endpoint blocklist does not cover /api/kernels, and the websocket wrapper previously tracked idle activity without authorizing executable messages. This issue is fixed in version 3.2.6.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00523 44th percentileScored 2026-11-07
Fix Fixed mercury (mljar): 3.2.6mercury (PyPI): 3.2.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
mljarmercurybefore 3.2.63.2.6Patch availableCNA
—mercury (PyPI)before 3.2.63.2.6Patch availableGHSA-rv4m-xm3f-3ccq
  • mercury Vendormljar Affected before 3.2.6 Fixed in 3.2.6 Patch available CNA
  • mercury (PyPI) Vendor— Affected before 3.2.6 Fixed in 3.2.6 Patch available GHSA-rv4m-xm3f-3ccq

Remediation

Upgrade the mercury package on PyPI to version 3.2.6, which fixes this issue. The mljar mercury entry lists versions before 3.2.6 as affected with no fix listed.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA mercury (mljar) Fixed in 3.2.6
  • Fix · GHSA-rv4m-xm3f-3ccq mercury (PyPI) Fixed in 3.2.6 Advisory →

Timeline

  1. 2026-10-19 Threatist record created from CVE-2026-111058
  2. 2026-10-19 Alias added: GHSA-rv4m-xm3f-3ccq
  3. 2026-10-19 Fix available: PyPI/[email protected] · GHSA-rv4m-xm3f-3ccq
  4. 2026-10-19 CVSS score added · GHSA-rv4m-xm3f-3ccq
  5. 2026-10-19 Weakness changed · GHSA-rv4m-xm3f-3ccq
  6. 2026-10-19 4 new references · GHSA-rv4m-xm3f-3ccq
  7. 2026-10-19 CISA SSVC decision points changed

References

Other 4

  • TI-2026-76429 Mercury: unauthenticated remote code execution via /api/terminals bypass CVSS 3.1CRITICAL 10.0
  • TI-2025-01287 Remote Code Execution in PlotAI CVSS 4.0CRITICAL 9.3
  • TI-2026-76431 Mercury mr.Markdown renders untrusted Markdown as unsanitized HTML (XSS) CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences