Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorization
影響: pip:jupyter-server >= 2.0.0, < 2.6.0 → 2.6.0
Jupyter Server's gateway WebSocket handler checks that a user is authenticated, but it does not ask the configured Authorizer whether that user may execute kernels. In Jupyter Server 2.0.0 through 2.5.0, enabling GatewayClient.url automatically replaced the normal kernel channel handler with this gateway-specific handler. An authenticated user who is denied the execute action on the kernels resource can therefore still open a kernel channel and send messages to the upstream kernel. Details The…
| CVE | CVE-2026-114135 |
|---|---|
| 정보원 | GitHub Advisory Database |
| 수집 시각 | 2026. 10. 23. 오전 05:09 |
| 데이터 | Markdown JSON |
2026. 10. 23. 오전 12:46, GitHub Advisory Database에서 "Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorization"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "높음"(high)입니다. 관련 기술: Python. CVE: CVE-2026-114135.