How severe is CVE-2026-40110?

CVE-2026-40110 has a CVSS 3.x base score of 7.3, rated high severity. It is exploitable over network with low attack complexity, requires low privileges and user interaction. Impact on confidentiality is high, integrity high, and availability none.

Is CVE-2026-40110 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (25th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-40110?

CVE-2026-40110 affects Jupyter Jupyter Server. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-40110?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

Does CVE-2026-40110 have an EU (EUVD) identifier?

Yes. CVE-2026-40110 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-27510.

When was CVE-2026-40110 published?

CVE-2026-40110 was published on 2026-05-05 and last updated on 2026-06-30.

CVE-2026-40110

CVE-2026-40110 is a high-severity vulnerability in Jupyter Jupyter Server with a CVSS 3.x base score of 7.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-777.

Key facts

Severity: High (CVSS 3.x base score 7.3)
CVSS v4: 7.6
EPSS exploit prediction: 0% (25th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-27510
Weakness: CWE-777
Affected product: Jupyter Jupyter Server
Published: 2026-05-05
Last modified: 2026-06-30

Description

Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the Origin header validation uses Python's re.match() to check incoming origins against the allow_origin_pat configuration value. Because re.match() only anchors at the start of the string and does not require a full match, a pattern intended to match only a trusted domain (e.g., trusted.example.com) will also match any origin that begins with that domain followed by additional characters (e.g., trusted.example.com.evil.com). An attacker who controls such a domain can bypass the CORS origin restriction and make cross-origin requests to the Jupyter Server API from an untrusted site. This issue has been fixed in version 2.18.0.

Frequently asked questions

What is CVE-2026-40110?: Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the Origin header validation uses Python's re.match() to check incoming origins against the allow_origin_pat configuration value. Because re.match() only anchors at the start of the string and does not require a full match, a pattern intended to match only a trusted domain (e.g., trusted.example.com) will also match any origin that begins with that domain followed by additional characters (e.g., trusted.example.com.evil.com). An attacker who controls such a domain can bypass the CORS origin restriction and make cross-origin requests to the Jupyter Server API from an untrusted site. This issue has been fixed in version 2.18.0.
How severe is CVE-2026-40110?: CVE-2026-40110 has a CVSS 3.x base score of 7.3, rated high severity. It is exploitable over network with low attack complexity, requires low privileges and user interaction. Impact on confidentiality is high, integrity high, and availability none.
Is CVE-2026-40110 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (25th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-40110?: CVE-2026-40110 affects Jupyter Jupyter Server. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-40110?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2026-40110 have an EU (EUVD) identifier?: Yes. CVE-2026-40110 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-27510.
When was CVE-2026-40110 published?: CVE-2026-40110 was published on 2026-05-05 and last updated on 2026-06-30.

References

Affected products (1)

cpe:2.3:a:jupyter:jupyter_server:*:*:*:*:*:*:*:*

More vulnerabilities in Jupyter Jupyter Server

CVE-2026-6657 — High (CVSS 8.8): A vulnerability in jupyter-server versions 1.12.0 through 2.17.0 allows an attacker to bypass CORS origin validation…
CVE-2026-35397 — High (CVSS 8.8): Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, a path traversal…
CVE-2026-5422 — High (CVSS 8.1): A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary…
CVE-2024-35178 — High (CVSS 7.5): The Jupyter Server provides the backend for Jupyter web applications. Jupyter Server on Windows has a vulnerability…
CVE-2022-24757 — High (CVSS 7.5): The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web…
CVE-2022-29241 — High (CVSS 7.1): Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications…

All CVEs affecting Jupyter Jupyter Server →

Other CWE-777 vulnerabilities

CVE-2026-39087 — Medium (CVSS 6.4): ntfy before 2.22.0 allows SSRF because of an unanchored regular expression for web push endpoint URLs.

Browse all CWE-777 vulnerabilities →

Threat intelligence

Threat-intel indicators referencing this CVE:

129.212.181.245 (ipv4-addr)