An update for python-jupyter-server is now available for openEuler-24.03-LTS-SP4 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-4080 Final 1.0 1.0 2026-09-25 Initial 2026-09-25 2026-09-25 openEuler SA Tool V1.0 2026-09-25 python-jupyter-server security update An update for python-jupyter-server is now available for openEuler-24.03-LTS-SP4 The backend for Jupyter web applications Security Fix(es): Jupyter Server is the backend for Jupyter web applications. In jupyter_server versions through 2.17.0, the next query parameter in the login flow is insufficiently validated in `LoginFormHandler._redirect_safe()`, which allows redirects to arbitrary external domains via values such as `///example.com`. An attacker can use a crafted login URL to redirect users to a malicious site and facilitate phishing attacks. This issue is fixed in version 2.18.0.(CVE-2025-61669) Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, a path traversal vulnerability in the REST API allows an authenticated user to escape the configured root_dir and access sibling directories whose names begin with the same prefix as the root_dir. For example, with a root_dir named "test", the API permits access to a sibling directory named "testtest" through a crafted request to the /api/contents endpoint using encoded path components. An attacker can read, write, and delete files in affected sibling directories. Multi-tenant deployments using predictable naming schemes are particularly at risk, as a user with a directory named "user1" could access directories for user10 through user19 and beyond. A user who can choose a single-character folder name could gain access to a significant number of sibling directories. Version 2.18.0 contains a fix. As a workaround, ensure folder names do not share a common prefix with any sibling directory.(CVE-2026-35397) Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the Origin header validation uses Python's re.match() to check incoming origins against the allow_origin_pat configuration value. Because re.match() only anchors at the start of the string and does not require a full match, a pattern intended to match only a trusted domain (e.g., trusted.example.com) will also match any origin that begins with that domain followed by additional characters (e.g., trusted.example.com.evil.com). An attacker who controls such a domain can bypass the CORS origin restriction and make cross-origin requests to the Jupyter Server API from an untrusted site. This issue has been fixed in version 2.18.0.(CVE-2026-40110) Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the secret used to sign authentication cookies is persisted to a static file at ~/.local/share/jupyter/runtime/jupyter_cookie_secret and is never rotated when a user changes their password. After a password reset and server restart, any previously issued authentication cookie remains cryptographically valid because the signing key has not changed. An attacker who has captured a session cookie through any means retains full authenticated access to the server regardless of subsequent password changes. This affects deployments using password-based authentication, particularly shared or public-facing servers where credential rotation is expected to revoke existing sessions. This issue has been fixed in version 2.18.0.(CVE-2026-40934) An update for python-jupyter-server is now available for openEuler-24.03-LTS/openEuler-24.03-LTS-SP4. openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. High python-jupyter-server https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4080 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2025-61669 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-35397 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-40110 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-40934 https://nvd.nist.gov/vuln/detail/CVE-2025-61669 https://nvd.nist.gov/vuln/detail/CVE-2026-35397 https://nvd.nist.gov/vuln/detail/CVE-2026-40110 https://nvd.nist.gov/vuln/detail/CVE-2026-40934 openEuler-24.03-LTS-SP4 python-jupyter-server-2.13.0-3.oe2403sp4.src.rpm python3-jupyter-server-2.13.0-3.oe2403sp4.noarch.rpm Jupyter Server is the backend for Jupyter web applications. In jupyter_server versions through 2.17.0, the next query parameter in the login flow is insufficiently validated in `LoginFormHandler._redirect_safe()`, which allows redirects to arbitrary external domains via values such as `///example.com`. An attacker can use a crafted login URL to redirect users to a malicious site and facilitate phishing attacks. This issue is fixed in version 2.18.0. 2026-09-25 CVE-2025-61669 openEuler-24.03-LTS-SP4 Medium 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N python-jupyter-server security update 2026-09-25 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4080 Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, a path traversal vulnerability in the REST API allows an authenticated user to escape the configured root_dir and access sibling directories whose names begin with the same prefix as the root_dir. For example, with a root_dir named "test", the API permits access to a sibling directory named "testtest" through a crafted request to the /api/contents endpoint using encoded path components. An attacker can read, write, and delete files in affected sibling directories. Multi-tenant deployments using predictable naming schemes are particularly at risk, as a user with a directory named "user1" could access directories for user10 through user19 and beyond. A user who can choose a single-character folder name could gain access to a significant number of sibling directories. Version 2.18.0 contains a fix. As a workaround, ensure folder names do not share a common prefix with any sibling directory. 2026-09-25 CVE-2026-35397 openEuler-24.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H python-jupyter-server security update 2026-09-25 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4080 Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the Origin header validation uses Python's re.match() to check incoming origins against the allow_origin_pat configuration value. Because re.match() only anchors at the start of the string and does not require a full match, a pattern intended to match only a trusted domain (e.g., trusted.example.com) will also match any origin that begins with that domain followed by additional characters (e.g., trusted.example.com.evil.com). An attacker who controls such a domain can bypass the CORS origin restriction and make cross-origin requests to the Jupyter Server API from an untrusted site. This issue has been fixed in version 2.18.0. 2026-09-25 CVE-2026-40110 openEuler-24.03-LTS-SP4 High 7.3 AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N python-jupyter-server security update 2026-09-25 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4080 Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the secret used to sign authentication cookies is persisted to a static file at ~/.local/share/jupyter/runtime/jupyter_cookie_secret and is never rotated when a user changes their password. After a password reset and server restart, any previously issued authentication cookie remains cryptographically valid because the signing key has not changed. An attacker who has captured a session cookie through any means retains full authenticated access to the server regardless of subsequent password changes. This affects deployments using password-based authentication, particularly shared or public-facing servers where credential rotation is expected to revoke existing sessions. This issue has been fixed in version 2.18.0. 2026-09-25 CVE-2026-40934 openEuler-24.03-LTS-SP4 Medium 6.8 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N python-jupyter-server security update 2026-09-25 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4080