Authorization bypass in Jupyter Server Gateway WebSocket handler
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-862.
Summary
Jupyter Server from 2.0.0 before 2.6.0 is affected when GatewayClient.url is enabled. The gateway WebSocket handler authenticates users but skips the kernel execute authorization check (CWE-862). An authenticated user with restricted permissions can execute code in a kernel despite an Authorizer that denies it, exposing kernel data and credentials. The deprecated jupyter_server.gateway.handlers module keeps this bypass in 2.6.0 and later when registered manually.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
Jupyter Server is the backend for Jupyter web applications. From 2.0.0 until 2.6.0, enabling GatewayClient.url replaced the normal KernelWebsocketHandler with WebSocketChannelsHandler, which authenticated the user but did not call authorizer.is_authorized(...) for the execute action on the kernels resource. A restricted authenticated user could therefore open an upstream kernel channel and obtain kernel execution despite the configured Authorizer denying that action, exposing data and credentials available to the kernel and permitting modification or disruption of the kernel environment. The default gateway configuration is fixed in version 2.6.0. In 2.6.0 and later, the same authorization bypass remains possible when a deployment manually registers the deprecated jupyter_server.gateway.handlers module, because its handler still omits the configured kernel-execute authorization decision.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| jupyterlab | jupyter_server | 2.0.0 to before 2.6.0 | 2.6.0 | Patch available | CNA |
| — | jupyter-server (PyPI) | 2.0.0 to before 2.6.0 | 2.6.0 | Patch available | GHSA-354v-3q48-cv69 |
- jupyter_server Vendorjupyterlab Affected 2.0.0 to before 2.6.0 Fixed in 2.6.0 Patch available CNA
- jupyter-server (PyPI) Vendor— Affected 2.0.0 to before 2.6.0 Fixed in 2.6.0 Patch available GHSA-354v-3q48-cv69
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:jupyter:jupyter_server:*:*:*:*:*:*:*:* | — | — | jupyterlab |
- cpe:2.3:a:jupyter:jupyter_server:*:*:*:*:*:*:*:* Versions — — ·jupyterlab
Remediation
Upgrade jupyter-server to version 2.6.0 or later, which fixes the default gateway configuration. The sources list no fixed version for Red Hat OpenShift AI (RHOAI).
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA jupyter_server (jupyter-server) Fixed in 2.6.0
- Fix · GHSA-354v-3q48-cv69 jupyter-server (PyPI) Fixed in 2.6.0 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet |
Not affected: 1 product
- Red Hat OpenShift AI (RHOAI)
Timeline
- 2026-10-21 Threatist record created from CVE-2026-114135
- 2026-10-22 Affected versions changed · Red Hat
- 2026-10-22 CVSS score added · Red Hat
- 2026-10-22 Alias added: GHSA-354v-3q48-cv69
- 2026-10-22 Fix available: PyPI/[email protected] · GHSA-354v-3q48-cv69
- 2026-10-22 CVSS score added · GHSA-354v-3q48-cv69
- 2026-10-22 Weakness changed · GHSA-354v-3q48-cv69
- 2026-10-22 6 new references · GHSA-354v-3q48-cv69
- 2026-10-23 Affected versions changed · Red Hat
- 2026-10-23 Priority changed: MEDIUM → LOW
- 2026-10-28 CISA SSVC decision points changed
- 2026-10-28 Priority changed: LOW → MEDIUM
References
Other 5
- https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-354v-3q48-cv69
- https://github.com/jupyter-server/jupyter_server/pull/1261
- https://github.com/jupyter-server/jupyter_server/commit/35ffe5d435682128da16dc144a8e9e9f8fa85dd8
- https://github.com/jupyter-server/jupyter_server/releases/tag/v2.6.0
- https://github.com/jupyter-server/jupyter_server
More jupyterlab vulnerabilities
- TI-2026-32161 Jupyter Enterprise Gateway Has Kubernetes Manifest Injection via Jinja2 Template Rendering CVSS 4.0CRITICAL 10.0
- TI-2026-32160 Jupyter Enterprise Gateway: Jinja2 Template Server Side Template Injection results in Remote Code Execution CVSS 4.0CRITICAL 10.0
- TI-2026-32159 Jupyter Enterprise Gateway: ContainerProcessProxy._enforce_prohibited_ids can be Bypassed CVSS 3.1CRITICAL 9.8
- TI-2024-26623 Remote Code Execution (RCE) vulnerability in jupyterlab extension template `update-integration-tests` GitHub Action CVSS 3.1CRITICAL 10.0
- TI-2026-78983 Path traversal in nbconvert lets crafted notebooks write files CVSS 4.0HIGH 8.8
- TI-2026-39372 JupyterLab Git: Stored XSS leading to RCE CVSS 4.0CRITICAL 9.3
Sources
- CVE-2026-114135 · CVE Program
- CVE-2026-114135 · NVD
- FIRST EPSS
- GHSA-354v-3q48-cv69 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-114135 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences