Mercury: Unauthenticated remote code execution via Jupyter kernel endpoint

Summary

Mercury is a Python framework that publishes Jupyter notebooks as web applications and dashboards. In default deployments without a token, anonymous clients can create Jupyter kernels through /api/kernels and send execute_request messages with arbitrary Python code, because the endpoint blocklist does not cover this path. An attacker who can reach the service over the network can therefore execute code as the Mercury server process user without authentication, gaining access to the host or container and any data or secrets it can reach.

Affected

• Mercury versions before 3.2.6 (GitHub advisory lists <=3.2.5)
• Default deployments without a token (--token or MERCURY_TOKEN not set)

Fixed in

• Fixed in version 3.2.6
• Latest release at time of research: 3.2.11 (also contains fixes for CVE-2026-111059)

Workaround

• No workaround documented by the vendor; upgrading is the documented fix.
• Until patching, set a token and do not expose the service to the public internet (use VPN, firewall or an authenticating reverse proxy).
• The endpoint blocklist must not be relied upon as protection.

Exploitation

• Public proof-of-concept referenced in the vendor advisory and in third-party repositories.
• CISA SSVC: Automatable yes, Technical Impact total, Exploitation none.
• No evidence of exploitation in the wild found; CISA KEV not verified.

Our recommendation

• Inventory all Mercury instances, including containers and pip-installed copies.
• Upgrade to 3.2.6 at minimum; 3.2.11 is the newest release found.
• Verify that no instance runs without a token or is reachable from untrusted networks.
• Also patch CVE-2026-111057 (terminal endpoint bypass) by upgrading.
• Check logs for unexpected kernel creation or execute requests.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  ExDev994/CVE-2026-111058-CVE-2026-111057-mercury-rce

Research sources

• GitHub Security Advisory GHSA-rv4m-xm3f-3ccq github.com
• Mercury release 3.2.6 github.com
• Mercury fix commit 73a40ce github.com
• OSV GHSA-rv4m-xm3f-3ccq osv.dev
• GitLab Advisory Database CVE-2026-111058 advisories.gitlab.com
• SecurityFocus GHSA-rv4m-xm3f-3ccq www.securityfocus.com
• Debricked package overview mercury debricked.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 17:26.