CVE-2026-40110 jupyter-server CORS origin validation bypass via unanchored regex in allow_origin_pat

🗓️ 05 May 2026 21:29:31Reported by GoogleType

osv🔗 osv.dev👁 1 Views

CORS origin validation bypass in Jupyter Server up to 2.17.0 caused by unanchored regular expression; fixed in 2.18.0.

Reporter	Title	Published	Views	Family All 28
ATTACKERKB	CVE-2026-40110	5 May 202621:29	–	attackerkb
AlpineLinux	CVE-2026-40110	5 May 202621:29	–	alpinelinux
Chainguard	CVE-2026-40110 vulnerabilities	7 May 202613:17	–	cgr
Circl	CVE-2026-40110	6 May 202601:30	–	circl
CNNVD	Jupyter Server 安全漏洞	5 May 202600:00	–	cnnvd
CVE	CVE-2026-40110	5 May 202621:29	–	cve
Cvelist	CVE-2026-40110 jupyter-server CORS origin validation bypass via unanchored regex in allow_origin_pat	5 May 202621:29	–	cvelist
Debian CVE	CVE-2026-40110	5 May 202621:29	–	debiancve
EUVD	EUVD-2026-27510	5 May 202616:54	–	euvd
Github Security Blog	Jupyter Server has a CORS Origin Validation Bypass via `re.match()` in `allow_origin_pat` (from huntr)	5 May 202616:54	–	github

Source	Link
security	www.security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40110.json
access	www.access.redhat.com/security/cve/CVE-2026-40110
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40110.json
github	www.github.com/jupyter-server/jupyter_server/security/advisories/GHSA-24qx-w28j-9m6p
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-40110
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/jupyter-server/jupyter_server/commit/057869a327c46730afede3eab0ca2d2e3e74acea
github	www.github.com/jupyter-server/jupyter_server/commit/49b34392feaa97735b3b777e3baf8f22f2a14ed8
github	www.github.com/jupyter-server/jupyter_server/pull/603

13 Jul 2026 07:26Current

5.9Medium risk

Vulners AI Score5.9

CVSS 47.6

EPSS0.00333