DEBIAN-CVE-2026-6657
A vulnerability in jupyter-server versions 1.12.0 through 2.17.0 allows an attacker to bypass CORS origin validation when the `allow_origin_pat` configuration is used. The issue arises from the use of `re.match()` for validating the `Origin` header, which only anchors at the start of the string. This allows attacker-controlled domains such as `trusted.example.com.evil.com` to pass validation against patterns intended to match `trusted.example.com`. The vulnerability affects multiple locations in the codebase, including CORS headers, WebSocket connections, referer validation, and login redirects, potentially enabling phishing attacks, arbitrary code execution, and unauthorized access to sensitive API responses.
DEBIAN-CVE-2026-6657
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:DEBIAN-CVE-2026-6657
jupyter-server
Source reference: /affected/0/package/name
- Affected versions
- 1.23.3-1
Source reference:
/affected/0/versions1.23.3-2Source reference:
/affected/0/versions2.14.0-1Source reference:
/affected/0/versions2.14.2-1Source reference:
/affected/0/versions2.14.2-2Source reference:
/affected/0/versions2.14.2-3Source reference:
/affected/0/versions2.14.2-4Source reference:
/affected/0/versions2.14.2-5Source reference:
/affected/0/versions2.15.0-1Source reference:
/affected/0/versions2.17.0-1Source reference:
/affected/0/versions2.20.0-1Source reference:
/affected/0/versions2.20.0-2Source reference:
/affected/0/versions2.20.0-3Source reference:
/affected/0/versions2.9.1-1Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
jupyter-server
Source reference: /affected/1/package/name
- Affected versions
- 2.15.0-1
Source reference:
/affected/1/versions2.17.0-1Source reference:
/affected/1/versions2.20.0-1Source reference:
/affected/1/versions2.20.0-2Source reference:
/affected/1/versions2.20.0-3Source reference:
/affected/1/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
jupyter-server
Source reference: /affected/2/package/name
- Affected versions
- 2.15.0-1
Source reference:
/affected/2/versions2.17.0-1Source reference:
/affected/2/versions2.20.0-1Source reference:
/affected/2/versions2.20.0-2Source reference:
/affected/2/versions2.20.0-3Source reference:
/affected/2/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "jupyter-server",
"purl": "pkg:deb/debian/jupyter-server?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"1.23.3-1",
"1.23.3-2",
"2.14.0-1",
"2.14.2-1",
"2.14.2-2",
"2.14.2-3",
"2.14.2-4",
"2.14.2-5",
"2.15.0-1",
"2.17.0-1",
"2.20.0-1",
"2.20.0-2",
"2.20.0-3",
"2.9.1-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-6657.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "jupyter-server",
"purl": "pkg:deb/debian/jupyter-server?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"2.15.0-1",
"2.17.0-1",
"2.20.0-1",
"2.20.0-2",
"2.20.0-3"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-6657.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "jupyter-server",
"purl": "pkg:deb/debian/jupyter-server?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"2.15.0-1",
"2.17.0-1",
"2.20.0-1",
"2.20.0-2",
"2.20.0-3"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-6657.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #56059 · Revision 1
- Added to Heist Feed
- Publisher date