CVE-2026-6657 Overview
CVE-2026-6657 is a Cross-Origin Resource Sharing (CORS) origin validation bypass in jupyter-server versions 1.12.0 through 2.17.0. The vulnerability stems from improper use of Python's re.match() function when validating the Origin header against the allow_origin_pat configuration. Because re.match() only anchors at the start of the string, attacker-controlled domains such as trusted.example.com.evil.com pass validation intended to match trusted.example.com. The flaw affects CORS headers, WebSocket connections, referer validation, and login redirects.
Critical Impact
Attackers can bypass origin restrictions to launch phishing campaigns, execute arbitrary code, and access sensitive Jupyter API responses from malicious cross-origin contexts.
Affected Products
- jupyter-server 1.12.0 through 2.17.0
- Jupyter Notebook deployments using allow_origin_pat configuration
- JupyterLab environments built on affected jupyter-server versions
Discovery Timeline
- 2026-06-03 - CVE-2026-6657 published to NVD
- 2026-06-03 - Last updated in NVD database
Technical Details for CVE-2026-6657
Vulnerability Analysis
The vulnerability is classified as Origin Validation Error [CWE-346]. The jupyter-server package uses the allow_origin_pat setting to define a regular expression pattern that restricts which origins can interact with the server. Administrators rely on this mechanism to enforce strict cross-origin policies for notebook deployments.
The validation routine invokes Python's re.match() against the incoming Origin header value. re.match() only anchors the pattern at the beginning of the string and does not require a match against the entire input. As a result, any string that starts with the trusted pattern is accepted, regardless of trailing characters.
An attacker registering trusted.example.com.evil.com can pass a check intended to allow only trusted.example.com. The same flawed validation appears in multiple code paths, including CORS preflight handling, WebSocket upgrade requests, referer validation, and login redirect targets. This broadens the attack surface beyond simple browser-based CORS abuse.
Root Cause
The root cause is the use of re.match() without a terminating $ anchor or the use of re.fullmatch(). Pattern authors expect full-string matching semantics, but Python only enforces a prefix match. The mismatch between developer intent and library behavior allows crafted hostnames to satisfy the validator.
Attack Vector
Exploitation requires user interaction, typically by enticing a victim to visit an attacker-controlled domain whose name extends a trusted origin. The malicious page issues cross-origin requests or initiates a WebSocket upgrade against the victim's authenticated Jupyter session. Because the server treats the origin as trusted, it returns CORS headers permitting the attacker's JavaScript to read API responses, execute notebook code, or redirect the user during login flows. No verified public exploit code is available; see the Huntr Bug Bounty Report for technical details.
Detection Methods for CVE-2026-6657
Indicators of Compromise
- HTTP requests containing an Origin or Referer header where a trusted hostname is followed by additional subdomain components (for example trusted.example.com.attacker.tld).
- WebSocket upgrade requests originating from domains that extend an approved origin pattern.
- Login redirect parameters pointing to hostnames that prefix-match approved domains but contain extra trailing labels.
Detection Strategies
- Inspect reverse proxy and Jupyter access logs for Origin headers that contain a legitimate domain as a substring followed by additional characters.
- Audit deployed jupyter_server_config.py files for allow_origin_pat values lacking explicit end-of-string anchors.
- Correlate authenticated Jupyter API calls with anomalous cross-origin request patterns from previously unseen referers.
Monitoring Recommendations
- Forward Jupyter server logs to a centralized SIEM and alert on suspicious Origin header structures.
- Monitor outbound DNS lookups from user workstations for newly registered domains that extend internal hostnames.
- Track jupyter-server version inventory across hosts to identify systems still running 1.12.0 through 2.17.0.
How to Mitigate CVE-2026-6657
Immediate Actions Required
- Upgrade jupyter-server to a version later than 2.17.0 that contains the fix for the origin validation logic.
- Audit all production and development deployments for use of allow_origin_pat and confirm the configured patterns include proper anchors.
- Restrict network exposure of Jupyter instances behind authenticated reverse proxies or VPNs while patching is in progress.
Patch Information
Review the Huntr Bug Bounty Report for the upstream remediation reference. The fix replaces re.match() with full-string matching semantics so that allow_origin_pat patterns must match the entire Origin value rather than just its prefix.
Workarounds
- Modify allow_origin_pat patterns to explicitly terminate with $ so prefix-only matches are rejected.
- Where feasible, replace allow_origin_pat with an exact-match allow_origin list to eliminate regex ambiguity.
- Enforce strict Content-Security-Policy and Sec-Fetch-Site checks at an upstream proxy to reject unexpected cross-origin requests.
# Configuration example: anchor allow_origin_pat to prevent prefix-match bypass
# In jupyter_server_config.py
c.ServerApp.allow_origin_pat = r'^https://([a-z0-9-]+\.)?example\.com$'
# Or prefer explicit allow_origin entries when possible
c.ServerApp.allow_origin = 'https://trusted.example.com'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
