Quick answers
- Is CVE-2026-6657 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-6657 being exploited in the wild.
- How severe is CVE-2026-6657?
- Medium severity, with a CVSS score of 6.1, published 3 June 2026.
- Which products and versions are affected?
- jupyter-server (PyPI) ECOSYSTEM:introduced=1.12.0,last_affected=2.17.0.
- Is there a fix for CVE-2026-6657?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-6657 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-6657?
- Check whether you run jupyter-server (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A vulnerability exists in jupyter-server (versions 1.12.0 through 2.17.0) due to improper validation of the Origin header when the `allow_origin_pat` configuration is active. The server uses Python's `re.match()` function, which only anchors the regular expression at the beginning of the string. This allows an attacker to bypass security checks by using a subdomain they control that begins with a legitimate, trusted domain string (e.g., `trusted.example.com.attacker.com`). The flaw impacts CORS headers, WebSocket connections, referer validation, and login redirects. Successful exploitation requires a user to visit a malicious site (User Interaction) and can result in sensitive data exposure or arbitrary code execution via compromised WebSocket communication.
Affected products
- Jupyter jupyter-server 1.12.0 - 2.17.0
Identifiers
- CVE-2026-6657
- GHSA-v42x-x7jp-845h
- PYSEC-2026-3472
Timeline
- 2026-06-03: disclosed
- 2026-06-03: advisory