The vulnerability in jupyter_server (CVE-2026-40110) arises from the use of Python's re.match() for validating the Origin header against the allow_origin_pat configuration. Since re.match() anchors only at the start of the string and does not enforce a full match, a pattern intended to match a trusted domain (e.g., trusted.example.com) can be bypassed by origins starting with that domain but followed by additional characters (e.g., trusted.example.com.evil.com). This allows an attacker controlling such a domain to circumvent CORS restrictions and perform cross-origin API requests. The vulnerability affects versions up to 2.17.0 and is resolved in version 2.18.0.

An attacker controlling a domain name that prefixes a trusted domain can bypass CORS origin restrictions on Jupyter Server API endpoints, potentially allowing unauthorized cross-origin requests. This could lead to unauthorized actions or data exposure via the API. The CVSS 4.0 score is 7.6 (high severity), reflecting network attack vector, low attack complexity, partial user interaction, and high impact on confidentiality and integrity.

Upgrade jupyter_server to version 2.18.0 or later where this issue is fixed. Since this is a code-level validation flaw, applying the official update is the recommended remediation. Patch status is confirmed fixed in version 2.18.0. No other vendor advisory or temporary mitigations are provided.