PyPI/jupyter-server CVE-2026-114135: high 8.8

Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorization

Action: Upgrade jupyter-server to 2.6.0 or later.

pip install jupyter-server==2.6.0

Affected

Fixed versions

Sources

• osv: GHSA-354v-3q48-cv69
• https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-354v-3q48-cv69
• https://nvd.nist.gov/vuln/detail/CVE-2026-114135
• https://github.com/jupyter-server/jupyter_server/pull/1261
• https://github.com/jupyter-server/jupyter_server/commit/35ffe5d435682128da16dc144a8e9e9f8fa85dd8
• https://github.com/jupyter-server/jupyter_server
• https://github.com/jupyter-server/jupyter_server/releases/tag/v2.6.0

CVE-2026-114135 · published 2026-10-22T15:46:31Z · modified 2026-10-22T16:00:09.146840746Z · JSON