IT SBIT Services
Schneeberger
DEEN
CVE tracker

Jupyter Server: Missing authorization for kernel execution in Gateway WebSocket handler

CVE-2026-114135High 8.8

← All vulnerabilities

Summary

Jupyter Server versions 2.0.0 up to 2.6.0 have a missing authorization check when GatewayClient.url is configured. The gateway WebSocket handler authenticates the user but does not ask the configured Authorizer whether the kernel execute action is allowed. An authenticated restricted user can therefore open an upstream kernel channel and run code in the kernel, which can expose data and credentials available to the kernel and allow modification or disruption of the kernel environment. The deprecated jupyter_server.gateway.handlers module still has the same flaw when registered manually in version 2.6.0 and later.

Affected

  • Jupyter Server >= 2.0.0, < 2.6.0 with GatewayClient.url configured
  • Jupyter Server 2.6.0 and later, if the deprecated module jupyter_server.gateway.handlers is registered manually (no fixed version known for this configuration)

Fixed in

  • Fixed in Jupyter Server 2.6.0 for the default gateway configuration
  • No fix known for the manually registered deprecated jupyter_server.gateway.handlers module

Workaround

  • Unknown. No vendor-published workaround found.
  • Likely not affected if gateway mode (GatewayClient.url) is not used (analysis, not a vendor statement).
  • Remove any manual registration of jupyter_server.gateway.handlers.

Exploitation

  • No evidence of exploitation in the wild found. CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
  • No public proof of concept found.

Our recommendation

  • Inventory Jupyter Server versions (for example pip show jupyter-server, lockfiles, container images) and upgrade to 2.6.0 or later.
  • Check whether GatewayClient.url is set; if yes, prioritise the upgrade.
  • Check for and remove manual registrations of jupyter_server.gateway.handlers.
  • Review which users have restricted Authorizer rights and whether those accounts are still needed.
  • Make sure Jupyter servers are not reachable from the internet unless required.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 11:07.

Original description (NVD)

Jupyter Server is the backend for Jupyter web applications. From 2.0.0 until 2.6.0, enabling GatewayClient.url replaced the normal KernelWebsocketHandler with WebSocketChannelsHandler, which authenticated the user but did not call authorizer.is_authorized(...) for the execute action on the kernels resource. A restricted authenticated user could therefore open an upstream kernel channel and obtain kernel execution despite the configured Authorizer denying that action, exposing data and credentials available to the kernel and permitting modification or disruption of the kernel environment. The default gateway configuration is fixed in version 2.6.0. In 2.6.0 and later, the same authorization bypass remains possible when a deployment manually registers the deprecated jupyter_server.gateway.handlers module, because its handler still omits the configured kernel-execute authorization decision.

NVD references (4)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed