CVE-2026-114135: CWE-862: Missing Authorization in jupyter-server jupyter_server
Description
Jupyter Server versions from 2.0.0 up to but not including 2.6.0 have a missing authorization check vulnerability when GatewayClient.url is enabled. This flaw allows an authenticated but restricted user to bypass authorization controls and execute code on the kernel, potentially exposing sensitive data and allowing modification or disruption of the kernel environment. The issue is fixed in version 2.6.0 for default gateway configurations. However, in 2.6.0 and later, if the deprecated jupyter_server.gateway.handlers module is manually registered, the authorization bypass remains possible.
CVSS v3.1
Score 8.8high
Affected software
jupyter-server
jupyter_server
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Jupyter Server, the backend for Jupyter web applications, contains a missing authorization vulnerability (CWE-862) in versions >=2.0.0 and <2.6.0. When GatewayClient.url is enabled, the normal KernelWebsocketHandler is replaced by WebSocketChannelsHandler, which authenticates users but fails to invoke authorizer.is_authorized(...) for the kernel execute action. This allows restricted authenticated users to open an upstream kernel channel and execute code despite authorization denials, exposing kernel data and credentials and permitting kernel environment modification or disruption. The default gateway configuration is fixed in version 2.6.0. However, manual registration of the deprecated jupyter_server.gateway.handlers module in 2.6.0 and later still allows this authorization bypass.
Potential Impact
An authenticated user with restricted permissions can bypass authorization controls to execute code on the Jupyter kernel. This can lead to exposure of sensitive data and credentials accessible to the kernel, as well as unauthorized modification or disruption of the kernel environment. The vulnerability has a high CVSS score of 8.8, indicating a high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
Upgrade Jupyter Server to version 2.6.0 or later to obtain the official fix for the default gateway configuration. Avoid manually registering the deprecated jupyter_server.gateway.handlers module in versions 2.6.0 and later, as it still allows the authorization bypass. Patch status is confirmed fixed in 2.6.0 for default configurations. Check vendor advisories for any additional guidance if using deprecated modules.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-10-20T21:53:58.473Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ad91d8b4d27ba8daafb722d
Added to database: 10/21/2026, 20:16:11 UTC
Last enriched: 10/21/2026, 20:30:22 UTC
Last updated: 10/21/2026, 20:35:22 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.