CVE-2026-6657

Name of the Vulnerable Software and Affected Versions jupyter-server versions 1.12.0 through 2.17.0

Description An issue exists when the allow origin pat configuration is used, allowing an attacker to bypass Cross-Origin Resource Sharing (CORS) origin validation. This occurs because the re.match() function is used to validate the Origin header, which only anchors the match at the start of the string. Consequently, attacker-controlled domains (e.g., trusted.example.com.evil.com) can pass validation against patterns intended for trusted.example.com. This flaw affects CORS headers, WebSocket connections, referer validation, and login redirects, which could lead to phishing attacks, arbitrary code execution, and unauthorized access to sensitive API responses.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.