Skip to content
OpenAdvisories

Package · Alpine

jupyter-server

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.6
    CVE-2026-40934

    jupyter-server authentication cookies remain valid after password reset due to static cookie secret

    Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the secret used to sign authentication cookies is persisted to a static file at ~/.local/share/jupyter/runtime/jupyter_cookie_secret and is never rotated when a user c…

    jupyter-server jupyter_server jupyter-server jupyter-server Debian Ubuntu Alpine PyPI
  • High 7.6
    CVE-2026-40110

    jupyter-server CORS origin validation bypass via unanchored regex in allow_origin_pat

    Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the Origin header validation uses Python's re.match() to check incoming origins against the allow_origin_pat configuration value. Because re.match() only anchors at th…

    jupyter-server jupyter_server jupyter-server jupyter-server Debian Ubuntu Alpine PyPI
  • High 7.6
    CVE-2026-35397 Public exploit

    jupyter-server path traversal allows access to sibling directories sharing root_dir name prefix

    Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, a path traversal vulnerability in the REST API allows an authenticated user to escape the configured root_dir and access sibling directories whose names begin with the…

    jupyter-server jupyter_server jupyter-server jupyter-server Debian Ubuntu Alpine PyPI