susvibes-jupyter-server-cve-2026-35397

SusVibes Benchmark Task: Jupyter Server Contents Path Resolution This repository contains one complete SusVibes-style benchmark task built from a real upstream Python security fix in Jupyter Server. The task is designed to evaluate whether an agent can reimplement masked contents path-resolution...

Linux Distros Unpatched Vulnerability : CVE-2026-114135

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Jupyter Server is the backend for Jupyter web applications. From 2.0.0 until 2.6.0, enabling GatewayClient.url replaced the normal KernelWebsocketHandler with...

CVE-2026-114135

Jupyter Server is the backend for Jupyter web applications. From 2.0.0...

UBUNTU-CVE-2026-114135

Jupyter Server is the backend for Jupyter web applications. From 2.0.0...

SUSE CVE-2026-114135

Jupyter Server is the backend for Jupyter web applications. From 2.0.0 until 2.6.0, enabling GatewayClient.url replaced the normal KernelWebsocketHandler with WebSocketChannelsHandler, which authenticated the user but did not call authorizer.isauthorized... for the execute action on the kernels...

GHSA-354V-3Q48-CV69 Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorization

Summary Jupyter Server's gateway WebSocket handler checks that a user is authenticated, but it does not ask the configured Authorizer whether that user may execute kernels. In Jupyter Server 2.0.0 through 2.5.0, enabling GatewayClient.url automatically replaced the normal kernel channel handler...

EUVD-2026-107544

Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorization...

cadpr (>=0.1.0, <=0.1.1), cfnow (>=0.0.1, <=0.0.6) +19 more potentially affected by CVE-2026-114135 via jupyter-server (>=2.0.1, <=2.5.0)

jupyter-server PYPI version =2.0.1, =0.1.0, =0.0.1, =3.14.0, =3.14.0, =3.14.0, =3.14.0, =3.14.0, =3.14.0, =0.3.0, =0.1.2, =0.1.3, =0.0.83, =0.2.13 and more Source cves: CVE-2026-114135 Source advisory: GHSA-354V-3Q48-CV69...

cadpr (>=0.1.0, <=0.1.1), cfnow (>=0.0.1, <=0.0.6) +19 more potentially affected by CVE-2026-114135 via jupyter-server (>=2.0.1, <=2.5.0)

jupyter-server PYPI version =2.0.1, =0.1.0, =0.0.1, =3.14.0, =3.14.0, =3.14.0, =3.14.0, =3.14.0, =3.14.0, =0.3.0, =0.1.2, =0.1.3, =0.0.83, =0.2.13 and more Source cves: CVE-2026-114135 Source advisory: OSV:GHSA-354V-3Q48-CV69...

cadpr (>=0.1.0, <=0.1.1), cfnow (>=0.0.1, <=0.0.6) +19 more potentially affected by CVE-2026-114135 via jupyter-server (>=2.0.1, <=2.5.0)

jupyter-server PYPI version =2.0.1, =0.1.0, =0.0.1, =3.14.0, =3.14.0, =3.14.0, =3.14.0, =3.14.0, =3.14.0, =0.3.0, =0.1.2, =0.1.3, =0.0.83, =0.2.13 and more Source cves: CVE-2026-114135 Source advisory: SNYK:PYTHON-JUPYTERSERVER-21431473...

Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorization

Summary Jupyter Server's gateway WebSocket handler checks that a user is authenticated, but it does not ask the configured Authorizer whether that user may execute kernels. In Jupyter Server 2.0.0 through 2.5.0, enabling GatewayClient.url automatically replaced the normal kernel channel handler...

CVE-2026-114135

A flaw was found in jupyter-server. When configured with a gateway connection, the server validates user authentication but fails to verify whether the user has permission to run actions on computational kernels. A remote authenticated user with restricted privileges can exploit this flaw to open...

DEBIAN-CVE-2026-114135

Jupyter Server is the backend for Jupyter web applications. From 2.0.0 until 2.6.0, enabling GatewayClient.url replaced the normal KernelWebsocketHandler with WebSocketChannelsHandler, which authenticated the user but did not call authorizer.isauthorized... for the execute action on the kernels...

CVE-2026-114135

Jupyter Server is the backend for Jupyter web applications. From 2.0.0 until 2.6.0, enabling GatewayClient.url replaced the normal KernelWebsocketHandler with WebSocketChannelsHandler, which authenticated the user but did not call authorizer.isauthorized... for the execute action on the kernels...

CVE-2026-114135 Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorization

Jupyter Server is the backend for Jupyter web applications. From 2.0.0 until 2.6.0, enabling GatewayClient.url replaced the normal KernelWebsocketHandler with WebSocketChannelsHandler, which authenticated the user but did not call authorizer.isauthorized... for the execute action on the kernels...

CVE-2026-114135 Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorization

Jupyter Server is the backend for Jupyter web applications. From 2.0.0 until 2.6.0, enabling GatewayClient.url replaced the normal KernelWebsocketHandler with WebSocketChannelsHandler, which authenticated the user but did not call authorizer.isauthorized... for the execute action on the kernels...

CVE-2026-114135

Jupyter Server (versions 2.0.0 through 2.6.0) is vulnerable to an authorization bypass when GatewayClient.url is enabled. The WebSocketChannelsHandler fails to call authorizer.is_authorized(...) for the execute action on the kernels resource, allowing a restricted authenticated user to open an up...

CVE-2026-114135

Jupyter Server is the backend for Jupyter web applications. From 2.0.0 until 2.6.0, enabling GatewayClient.url replaced the normal KernelWebsocketHandler with WebSocketChannelsHandler, which authenticated the user but did not call authorizer.isauthorized... for the execute action on the kernels...

cadpr (>=0.1.0, <=0.1.1), cfnow (>=0.0.1, <=0.0.6) +19 more potentially affected by CVE-2026-114135 via jupyter-server (>=2.0.1, <=2.5.0)

jupyter-server PYPI version =2.0.1, =0.1.0, =0.0.1, =3.14.0, =3.14.0, =3.14.0, =3.14.0, =3.14.0, =3.14.0, =0.3.0, =0.1.2, =0.1.3, =0.0.83, =0.2.13 and more Source cves: CVE-2026-114135 Source advisory: MEND:CVE-2026-114135...

CVE-2026-114135

Jupyter Server is the backend for Jupyter web applications. From 2.0.0 until 2.6.0, enabling GatewayClient.url replaced the normal KernelWebsocketHandler with WebSocketChannelsHandler, which authenticated the user but did not call authorizer.isauthorized... for the execute action on the kernels...