CVE-2026-40110: jupyter-server jupyter_server Regular Expression without Anchors
Vulnerability summary
CVE-2026-40110 is a high (CVSS 7.6) Regular Expression without Anchors vulnerability in jupyter-server jupyter_server. EPSS estimates a 0.47% chance of exploitation in the next 30 days, higher than 39.3% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1 · Related 2Timeline
- 05-05-2026PublishedVulnerability first disclosed.
- 22-07-2026Last modifiedVulnerability information updated.
Description
Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the Origin header validation uses Python's re.match() to check incoming origins against the allow_origin_pat configuration value. Because re.match() only anchors at the start of the string and does not require a full match, a pattern intended to match only a trusted domain (e.g., trusted.example.com) will also match any origin that begins with that domain followed by additional characters (e.g., trusted.example.com.evil.com). An attacker who controls such a domain can bypass the CORS origin restriction and make cross-origin requests to the Jupyter Server API from an untrusted site. This issue has been fixed in version 2.18.0.
CVSS metrics
9 scores · 6 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.6HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L
- OSV · ChainguardEcosystem advisory · calculated7.6HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L
- NVDNIST7.6HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · PypiEcosystem advisory · calculated7.3HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated7.3HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:NDiffers
- OSV · DebianEcosystem advisory · calculated7.3HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:NDiffers
- NVDNIST7.3HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:NDiffers
EPSS trend
Probability
0.47%
Chance of exploitation in the next 30 days
Percentile
39%
Versus all other CVEs
30-day change
+0.13 pp
From 0.34% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-777Regular Expression without AnchorsThe product uses a regular expression to perform neutralization, but the regular expression is not anchored and may allow malicious or malformed data to slip through.
- CWE-625Permissive Regular ExpressionThe product uses a regular expression that does not sufficiently restrict the set of allowed values.
Affected systems
Chainguard2 products
- datahub-ingestion< 1.5.0.4-r0
- datahub-ingestion-fips< 1.5.0.1-r2
Debian1 product
- jupyter-serverAll versions (No fix recorded) | < 2.20.0-1
Jupyter1 product
- jupyter_server< 2.18.0
Jupyter-server1 product
- jupyter_server≤ 2.17.0
PyPI1 product
- jupyter-server< 2.18.0
Ubuntu1 product
- jupyter-serverAll versions (No fix recorded)
6 vendors · 7 products
References
15 links- github.com/jupyter-server/jupyter_server/security/advisories/GHSA-24qx-w28j-9m6pX Refsource CONFIRMWEBFIXREPORTAdvisoryMitigationPatchVendor Advisory
- github.com/jupyter-server/jupyter_server/commit/057869a327c46730afede3eab0ca2d2e3e74aceaX Refsource MISCWEBFIXREPORTPatch
- github.com/jupyter-server/jupyter_server/commit/49b34392feaa97735b3b777e3baf8f22f2a14ed8X Refsource MISCWEBFIXREPORTPatch
