CVE-2026-114135: jupyter_server >= 2.0.0, < 2.6.0

CVE-2026-114135. CVSS 3.1 base score 8.8 (HIGH, Vendor/CNA).

Affected technology

jupyter_server · >= 2.0.0, < 2.6.0
jupyter-server

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

A restricted authenticated user could therefore open an upstream kernel channel and obtain kernel execution despite the configured Authorizer denying that action, exposing data and credentials available to the kernel and permitting modification or disruption of the kernel environment. Vendor/CNA’s CVSS 3.1 assessment (base score 8.8/10) rates confidentiality, integrity and availability impact as high.

Published 22-Oct-2026 01:10 UTC

CWE: CWE-862
CCR priority: 35.2 /100 (P4)
CVSS 3.1: 8.8 /10 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · Vendor/CNA
KEV: no

Provenance

NVD CVE API 2.0 · Source record · observed 2026-10-22 01:08:24.561609+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-114135.html