Is CVE-2026-73627 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-73627 being exploited in the wild.

How severe is CVE-2026-73627?

Informational severity, with a CVSS score of 6, published 13 August 2026.

Which products and versions are affected?

Project Jupyter JupyterLab >=4.1.0, =4.6.0,<=4.6.1.

Is there a fix for CVE-2026-73627?

A patch was published on 2026: Fixed in JupyterLab 4.5.10 and 4.6.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-73627 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-73627?

Check whether you run Project Jupyter JupyterLab at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-73627: JupyterLab plugin manager lock-rule enforcement bypass

Q: Is there a fix for CVE-2026-73627?

A patch was published on 2026: Fixed in JupyterLab 4.5.10 and 4.6.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-73627 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-73627?

Check whether you run Project Jupyter JupyterLab at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-73627 · Severity: info · CVSS 6 · Published 2026-08-13

JupyterLab is a web-based interactive development environment widely used for data science and computing. Administrators can lock plugins to enforce security policies (e.g., restrict upload/download capabilities). An authenticated attacker can bypass these administrative locks by making direct API requests, enabling or disabling plugins at will and circumventing security restrictions—potentially exposing data or enabling unauthorized operations.

Technologies: Project Jupyter JupyterLab. Vendors: Project Jupyter.

Quick answers

Is CVE-2026-73627 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-73627 being exploited in the wild.
How severe is CVE-2026-73627?: Informational severity, with a CVSS score of 6, published 13 August 2026.
Which products and versions are affected?: Project Jupyter JupyterLab >=4.1.0,<=4.5.9 and >=4.6.0,<=4.6.1.
Is there a fix for CVE-2026-73627?: A patch was published on 2026: Fixed in JupyterLab 4.5.10 and 4.6.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-73627 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-73627?: Check whether you run Project Jupyter JupyterLab at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is a server-side enforcement gap in JupyterLab's plugin manager affecting versions 4.1.0–4.5.9 and 4.6.0–4.6.1. An authenticated user can send direct requests to the /lab/api/plugins endpoint to bypass administrator lock rules, including multi-plugin extensions and "lock all" mechanisms. The attack requires network access and valid authentication credentials; no user interaction is needed. An attacker can toggle plugin states to circumvent hardening measures such as upload/download limits. Patches are available in versions 4.5.10 and 4.6.2.

Affected products

Project Jupyter JupyterLab >=4.1.0,<=4.5.9 and >=4.6.0,<=4.6.1

Timeline

2026-07-21: disclosed
2026-08-13: advisory: Published on NVD
2026: patched: Fixed in JupyterLab 4.5.10 and 4.6.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.