CVE-2026-7810: Python Notebook MCP Path Traversal Flaw

CVE-2026-7810 Overview

CVE-2026-7810 is a path traversal vulnerability [CWE-22] in the UsamaK98 python-notebook-mcp project. The flaw affects the create_notebook, read_notebook, edit_cell, and add_cell functions in server.py. An unauthenticated remote attacker can manipulate file path inputs to read or write notebook files outside the intended directory. The project uses a rolling release model, so no fixed version is currently identified. A public exploit has been disclosed, and the maintainer has not responded to the issue report.

Critical Impact
Remote attackers can read, create, or modify files outside the intended notebook directory by abusing path traversal sequences in the affected Model Context Protocol (MCP) server functions.

Affected Products

UsamaK98 python-notebook-mcp (rolling release)
Commit a05a232815809a7e425b5fa7be26e0d4369894c2 and prior
Deployments exposing server.py MCP endpoints

Discovery Timeline

2026-05-05 - CVE-2026-7810 published to NVD
2026-05-05 - Last updated in NVD database

Technical Details for CVE-2026-7810

Vulnerability Analysis

The vulnerability resides in server.py of the python-notebook-mcp project, a Model Context Protocol server for managing Jupyter-style notebooks. Four functions accept file path arguments without proper validation: create_notebook, read_notebook, edit_cell, and add_cell. An attacker can supply traversal sequences such as ../ to escape the intended notebook directory.

Because the server processes these requests over the network without authentication, exploitation requires no credentials or user interaction. Successful exploitation may allow reading sensitive files, writing arbitrary notebook content to system locations, or tampering with files belonging to the host user. The maintainer has not responded to the upstream issue report, leaving deployments without an official fix.

Root Cause

The root cause is missing canonicalization and validation of user-controlled path parameters [CWE-22]. The affected functions concatenate or pass user input directly to filesystem operations without verifying that the resolved path remains within the configured notebook root directory.

Attack Vector

The attack vector is network-based. An attacker sends a crafted MCP request to one of the affected functions, supplying a path argument containing traversal sequences. The server resolves the path against the host filesystem and performs the requested read or write operation against the unintended target. Refer to the GitHub PoC Repository and the GitHub Issue Report for technical details. No verified exploit code is reproduced here.

Detection Methods for CVE-2026-7810

Indicators of Compromise

Notebook file paths in MCP request logs containing ../, ..\, URL-encoded traversal sequences such as %2e%2e%2f, or absolute paths like /etc/ or C:\.
Unexpected .ipynb files appearing outside the configured notebook root directory.
Read or write access by the python-notebook-mcp process to sensitive system files such as /etc/passwd, SSH keys, or user configuration files.

Detection Strategies

Inspect MCP server access logs for requests to create_notebook, read_notebook, edit_cell, and add_cell containing traversal patterns in the path parameter.
Apply file integrity monitoring on directories outside the notebook root that the service account can reach.
Correlate process telemetry from the host running server.py with filesystem events that fall outside the expected working directory.

Monitoring Recommendations

Forward MCP server logs and host telemetry to a centralized SIEM or data lake for path-traversal pattern matching.
Alert on any filesystem write originating from the notebook MCP process to paths outside its designated workspace.
Track network exposure of the MCP service and alert when it becomes reachable from untrusted networks.

How to Mitigate CVE-2026-7810

Immediate Actions Required

Restrict network exposure of the python-notebook-mcp service to trusted, authenticated clients only, ideally through a loopback interface or VPN.
Run the server as a low-privilege user with filesystem access limited to the notebook directory.
Audit the host for evidence of unauthorized file reads or writes through the affected functions.

Patch Information

No official patch is available. The maintainer has not responded to the upstream GitHub Issue Report. Operators should track the project repository and the VulDB advisory #361070 for fix availability. Until a patch lands, consider forking the project and applying local input validation, or migrating to a maintained MCP notebook server.

Workarounds

Wrap the affected functions to canonicalize the resolved path with os.path.realpath and reject any path that does not start with the notebook root directory.
Deploy the service inside a container or chroot with a read-only base filesystem and a single writable volume bound to the notebook directory.
Place a reverse proxy in front of the MCP server that rejects requests containing .., encoded traversal sequences, or absolute path prefixes.

bash

# Example sandboxing with a dedicated user and bind-mounted notebook directory
useradd -r -s /usr/sbin/nologin mcpuser
mkdir -p /srv/notebooks && chown mcpuser:mcpuser /srv/notebooks
systemd-run --uid=mcpuser --property=ProtectSystem=strict \
  --property=ReadWritePaths=/srv/notebooks \
  --property=PrivateTmp=yes \
  python server.py --notebook-dir /srv/notebooks