{"schema_version":"1.7.2","id":"OESA-2026-4080","modified":"2026-09-25T01:28:10Z","published":"2026-09-25T01:28:10Z","upstream":["CVE-2025-61669","CVE-2026-35397","CVE-2026-40110","CVE-2026-40934"],"summary":"python-jupyter-server security update","details":"The backend for Jupyter web applications\r\n\r\nSecurity Fix(es):\n\nJupyter Server is the backend for Jupyter web applications. In jupyter_server versions through 2.17.0, the next query parameter in the login flow is insufficiently validated in `LoginFormHandler._redirect_safe()`, which allows redirects to arbitrary external domains via values such as `///example.com`. An attacker can use a crafted login URL to redirect users to a malicious site and facilitate phishing attacks. This issue is fixed in version 2.18.0.(CVE-2025-61669)\n\nJupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, a path traversal vulnerability in the REST API allows an authenticated user to escape the configured root_dir and access sibling directories whose names begin with the same prefix as the root_dir. For example, with a root_dir named "test", the API permits access to a sibling directory named "testtest" through a crafted request to the /api/contents endpoint using encoded path components. An attacker can read, write, and delete files in affected sibling directories. Multi-tenant deployments using predictable naming schemes are particularly at risk, as a user with a directory named "user1" could access directories for user10 through user19 and beyond. A user who can choose a single-character folder name could gain access to a significant number of sibling directories. \n\nVersion 2.18.0 contains a fix. As a workaround, ensure folder names do not share a common prefix with any sibling directory.(CVE-2026-35397)\n\nJupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the Origin header validation uses Python's re.match() to check incoming origins against the allow_origin_pat configuration value. Because re.match() only anchors at the start of the string and does not require a full match, a pattern intended to match only a trusted domain (e.g., trusted.example.com) will also match any origin that begins with that domain followed by additional characters (e.g., trusted.example.com.evil.com). An attacker who controls such a domain can bypass the CORS origin restriction and make cross-origin requests to the Jupyter Server API from an untrusted site. This issue has been fixed in version 2.18.0.(CVE-2026-40110)\n\nJupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the secret used to sign authentication cookies is persisted to a static file at ~/.local/share/jupyter/runtime/jupyter_cookie_secret and is never rotated when a user changes their password. After a password reset and server restart, any previously issued authentication cookie remains cryptographically valid because the signing key has not changed. An attacker who has captured a session cookie through any means retains full authenticated access to the server regardless of subsequent password changes. This affects deployments using password-based authentication, particularly shared or public-facing servers where credential rotation is expected to revoke existing sessions. This issue has been fixed in version 2.18.0.(CVE-2026-40934)","affected":[{"package":{"ecosystem":"openEuler:24.03-LTS-SP4","name":"python-jupyter-server","purl":"pkg:rpm/openEuler/python-jupyter-server&distro=openEuler-24.03-LTS-SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.0-3.oe2403sp4"}]}],"ecosystem_specific":{"noarch":["python3-jupyter-server-2.13.0-3.oe2403sp4.noarch.rpm"],"src":["python-jupyter-server-2.13.0-3.oe2403sp4.src.rpm"]}}],"references":[{"type":"ADVISORY","url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4080"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61669"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35397"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40110"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40934"}],"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"database_specific":{"severity":"High"}}