CVE-2026-111058

Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. Prior to 3.2.6, default tokenless deployments allow anonymous clients to create Jupyter kernels and send executerequest messages containing arbitrary Python. The endpoint blocklist does not cover...

CVE-2026-111058 Mercury: Unauthenticated Remote Code Execution via /api/kernels

Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. Prior to 3.2.6, default tokenless deployments allow anonymous clients to create Jupyter kernels and send executerequest messages containing arbitrary Python. The endpoint blocklist does not cover...

EUVD-2026-104420

Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. Prior to 3.2.6, default tokenless deployments allow anonymous clients to create Jupyter kernels and send executerequest messages containing arbitrary Python. The endpoint blocklist does not cover...

CVE-2026-111058

The Mercury Python framework (prior to version 3.2.6 ) contains a vulnerability where default tokenless deployments allow anonymous clients to create Jupyter kernels. Attackers can send execute_request messages containing arbitrary Python code because the endpoint blocklist fails to cover /api/ke...

PT-2026-117481

Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. Prior to 3.2.6, default tokenless deployments allow anonymous clients to create Jupyter kernels and send execute request messages containing arbitrary Python. The endpoint blocklist does not cover...