CVE-2026-6657: Jupyter Server CORS Origin Validation Bypass Vulnerability

Technical summary

The vulnerability stems from the use of Python's `re.match()` function for validating the `Origin` header against the `allow_origin_pat` configuration. The `re.match()` function matches at the beginning of a string but does not require the pattern to match the entire value, allowing suffix-based bypasses. An attacker can submit an Origin header containing a trusted domain as a prefix followed by additional subdomain levels under attacker control (e.g., `trusted.example.com.evil.com`). This bypass propagates across multiple security-critical code paths: CORS header validation, WebSocket origin checks, referer header validation, and login redirect validation. The root cause is insufficient pattern anchoring—the patterns are not bounded with end-of-string anchors (e.g., `$` in regex), permitting substring exploitation. Affected versions range from 1.12.0 through 2.17.0.

Business impact

This vulnerability enables attackers to circumvent the origin validation controls that organizations rely on to prevent cross-origin attacks. Successful exploitation can lead to phishing attacks against Jupyter Server users, unauthorized access to sensitive API responses, potential remote code execution within the Jupyter environment, and session hijacking via WebSocket manipulation. For organizations using Jupyter Server to host shared computational environments or notebooks containing sensitive data, the business impact includes data theft, intellectual property loss, unauthorized code execution, and reputational damage. The vulnerability is particularly critical in multi-tenant or shared-access scenarios where origin validation provides a key security boundary.

Affected systems

Jupyter Server versions 1.12.0 through 2.17.0 are vulnerable. Organizations running Jupyter Server in any configuration—whether as a standalone service, within a JupyterHub deployment, or integrated into a larger data science platform—are affected if they rely on the `allow_origin_pat` configuration for CORS security. The vulnerability affects all platforms (Linux, macOS, Windows) on which Jupyter Server operates.

Exploitability

Exploitation requires moderate complexity and no elevated privileges. An attacker must craft a malicious web page or application that sends requests with a carefully constructed Origin header to a vulnerable Jupyter Server. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects network accessibility, low attack complexity, and no privilege requirements, but indicates user interaction is necessary—the targeted user must visit the attacker's page or be socially engineered to interact with malicious content. No special knowledge of the target's exact `allow_origin_pat` configuration is required; attackers can probe with various domain patterns. Public proof-of-concept demonstrations or weaponized exploits may accelerate real-world attack deployment.

Remediation

Administrators must upgrade Jupyter Server to a patched version that properly anchors origin validation patterns. Verify the latest patch version against the official Jupyter Server release notes and advisory. As a temporary mitigation, review and tighten `allow_origin_pat` configurations to be as restrictive as possible, ideally using exact domain matches rather than overly broad patterns. Disable CORS entirely if cross-origin access is not required for your use case. Monitor authentication logs and WebSocket connections for suspicious Origin headers that do not match expected legitimate sources.

Patch guidance

Apply the latest patched version of Jupyter Server released after the vulnerability disclosure. Verify the specific patch version from the official Jupyter project advisory. The fix involves replacing `re.match()` with a properly anchored pattern check (typically using `re.fullmatch()` or appending `$` anchors) across all affected code paths. Organizations should test the patched version in a non-production environment before rolling out organization-wide to ensure compatibility with their Jupyter deployments and any custom extensions or configurations.

Detection guidance

Monitor HTTP/HTTPS logs and WebSocket access logs for Origin headers that contain a known trusted domain as a substring but include additional unexpected subdomains or domain components (e.g., requests with Origin: trusted.example.com.attacker.com). Inspect CORS preflight requests (OPTIONS method) for suspicious patterns. Set up alerting on failed or unexpected origin validation events if your Jupyter Server instance logs such events. Intrusion detection systems can be tuned to flag requests with Origin headers that appear to be attempting domain confusion or header injection. Review logs for successful cross-origin API calls from unexpected origins, particularly those accessing sensitive endpoints or triggering code execution.

Why prioritize this

This vulnerability merits immediate attention due to its high CVSS score (8.8), broad attack surface spanning multiple security boundaries, and the direct compromise of a key security control (origin validation). The requirement for user interaction slightly reduces urgency compared to wormable network vulnerabilities, but phishing and social engineering are well-established attack vectors. Jupyter Server environments often contain or have access to sensitive computational data, intellectual property, or research. The vulnerability affects a widely used tool in data science and research communities.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects: network-based attack vector with no privilege escalation required, low attack complexity, high impact on confidentiality (unauthorized data access), high impact on integrity (unauthorized modification or code execution), and high impact on availability (potential service disruption). User interaction is required, which prevents a critical score, but the ease of social engineering and the broad applicability of the bypass make this a serious threat. The vulnerability directly undermines a critical security boundary in multi-tenant environments.

Frequently asked questions