CVE-2026-114135 Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorization

Jupyter Server is the backend for Jupyter web applications. From 2.0.0 until 2.6.0, enabling GatewayClient.url replaced the normal KernelWebsocketHandler with WebSocketChannelsHandler, which authenticated the user but did not call authorizer.isauthorized... for the execute action on the kernels...

CVE-2026-114135

Jupyter Server (versions 2.0.0 through 2.6.0) is vulnerable to an authorization bypass when GatewayClient.url is enabled. The WebSocketChannelsHandler fails to call authorizer.is_authorized(...) for the execute action on the kernels resource, allowing a restricted authenticated user to open an up...