CVE-2026-111057: Mercury: regex blocklist bypass allows unauthenticated RCE

Q: Is CVE-2026-111057 actively exploited?

No confirmed active exploitation of CVE-2026-111057 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-111057?

1) Upgrade mercury (pip) to 3.2.4 or later. 2) If patching must wait, block or deny /api/terminals (and the Jupyter terminals API generally) at the reverse proxy, WAF or load balancer, and restrict Mercury to authenticated or VPN-only access. 3) Run Mercury as a non-root, least-privilege user in a container with minimal mounts, a read-only filesystem where possible, restricted egress and no long-lived cloud credentials in its environment. 4) Detect: search web and proxy logs for requests to /api/terminals, especially from anonymous or external sources, and for WebSocket upgrades on terminal endpoints. Also look for unexpected child processes (sh, bash, curl, wget) spawned from the Mercury or Jupyter process. 5) If an exposed instance was running an affected version, treat it as potentially compromised: rotate every secret reachable by the process and review the host for persistence.

Q: What systems are affected by CVE-2026-111057?

This vulnerability affects the following AI/ML architecture patterns: Notebook-based dashboards and model demo hosting, Data science and ML workbenches, Model serving and sharing portals, Analytics platforms exposing Jupyter Server.

Q: What is the CVSS score for CVE-2026-111057?

CVE-2026-111057 has a CVSS v3.1 base score of 10.0 (CRITICAL). The EPSS exploitation probability is 0.70%.

GHSA-f8c7-rwf9-fmgmCRITICAL

Published October 19, 2026

CISO Take

Mercury, a framework that turns Jupyter notebooks into web apps and dashboards, has a missing comma in its anonymous-endpoint blocklist that merges two regex patterns. As a result, requests to /api/terminals skip the blocklist and reach Jupyter Server's terminal API, giving an unauthenticated remote attacker an interactive OS shell with the privileges of the Mercury process. The CVSS score is 10.0 (network, low complexity, no privileges, no user interaction, scope changed). Exploitation is not yet observed: EPSS is 0.44% (63rd percentile), the CVE is not in CISA KEV, and there is no public exploit or Nuclei template. The flaw is trivial to weaponize once the patch diff is read, and the package has about 3,043 downstream dependents, so urgency is high for any internet-exposed deployment. Upgrade to Mercury 3.2.4 immediately. Until then, block /api/terminals at the reverse proxy and review access logs for requests to that path.

Sources:NVDEPSSGitHub AdvisoryOpenSSFATLAS

What is the risk?

Critical. The attack is network-reachable, needs no authentication or user interaction, and has low complexity, which yields full confidentiality, integrity and availability loss. The changed scope reflects that a shell on the host reaches beyond the application boundary. Current exploitation likelihood is modest (EPSS 0.44%, no KEV listing, no public PoC, no scanner template). The fix commit is public, though, and the root cause is a one-character defect, so a working exploit is easy to build. Risk is highest for internet-facing Mercury instances that serve notebooks to anonymous users. The package has 72 other CVEs and an OpenSSF Scorecard of 5.8/10, which points to a mixed security posture.

How does the attack unfold?

Initial Access

The attacker sends an unauthenticated request to /api/terminals on an exposed Mercury server, and the merged regex lets it past the anonymous blocklist.

AML.T0049

Execution

The request reaches Jupyter Server's terminal API, and the attacker opens an interactive OS shell as the Mercury process user.

AML.T0050

Collection

The attacker reads notebooks, datasets, model files, environment variables and stored credentials on the host.

AML.T0037

Impact

The attacker exfiltrates data, tampers with notebooks or models, installs persistence and pivots into connected cloud and internal systems.

AML.T0048

Initial Access

The attacker sends an unauthenticated request to /api/terminals on an exposed Mercury server, and the merged regex lets it past the anonymous blocklist.

AML.T0049

Execution

The request reaches Jupyter Server's terminal API, and the attacker opens an interactive OS shell as the Mercury process user.

AML.T0050

Collection

The attacker reads notebooks, datasets, model files, environment variables and stored credentials on the host.

AML.T0037

Impact

The attacker exfiltrates data, tampers with notebooks or models, installs persistence and pivots into connected cloud and internal systems.

AML.T0048

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Jupyter Notebook	pip	>= 3.0.0, <= 3.2.3	`3.2.4`
13.5KOpenSSF 5.83.0K dependentsPushed 11d ago79% patched~75d to patchFull package profile →

Do you use Jupyter Notebook? You're affected.

How severe is it?

CVSS 3.1

10.0 / 10

EPSS

0.7%

chance of exploitation in 30 days

Higher than 53% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SChanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade mercury (pip) to 3.2.4 or later. 2) If patching must wait, block or deny /api/terminals (and the Jupyter terminals API generally) at the reverse proxy, WAF or load balancer, and restrict Mercury to authenticated or VPN-only access. 3) Run Mercury as a non-root, least-privilege user in a container with minimal mounts, a read-only filesystem where possible, restricted egress and no long-lived cloud credentials in its environment. 4) Detect: search web and proxy logs for requests to /api/terminals, especially from anonymous or external sources, and for WebSocket upgrades on terminal endpoints. Also look for unexpected child processes (sh, bash, curl, wget) spawned from the Mercury or Jupyter process. 5) If an exposed instance was running an affected version, treat it as potentially compromised: rotate every secret reachable by the process and review the host for persistence.

How is it classified?

Auth BypassCode ExecutionFrameworkPluginAML.T0037- Data from Local System AML.T0049- Exploit Public-Facing Application AML.T0050- Command and Scripting Interpreter AML.T0055- Unsecured Credentials

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Procedures to respond to and recover from unknown risks

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-111057?

Is CVE-2026-111057 actively exploited?

No confirmed active exploitation of CVE-2026-111057 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-111057?

1) Upgrade mercury (pip) to 3.2.4 or later. 2) If patching must wait, block or deny /api/terminals (and the Jupyter terminals API generally) at the reverse proxy, WAF or load balancer, and restrict Mercury to authenticated or VPN-only access. 3) Run Mercury as a non-root, least-privilege user in a container with minimal mounts, a read-only filesystem where possible, restricted egress and no long-lived cloud credentials in its environment. 4) Detect: search web and proxy logs for requests to /api/terminals, especially from anonymous or external sources, and for WebSocket upgrades on terminal endpoints. Also look for unexpected child processes (sh, bash, curl, wget) spawned from the Mercury or Jupyter process. 5) If an exposed instance was running an affected version, treat it as potentially compromised: rotate every secret reachable by the process and review the host for persistence.

What systems are affected by CVE-2026-111057?

This vulnerability affects the following AI/ML architecture patterns: Notebook-based dashboards and model demo hosting, Data science and ML workbenches, Model serving and sharing portals, Analytics platforms exposing Jupyter Server.

What is the CVSS score for CVE-2026-111057?

CVE-2026-111057 has a CVSS v3.1 base score of 10.0 (CRITICAL). The EPSS exploitation probability is 0.70%.

What is the AI security impact?

Affected AI Architectures

Notebook-based dashboards and model demo hostingData science and ML workbenchesModel serving and sharing portalsAnalytics platforms exposing Jupyter Server

MITRE ATLAS Techniques

AML.T0037Data from Local System

AML.T0049Exploit Public-Facing Application

AML.T0050Command and Scripting Interpreter

AML.T0055Unsecured Credentials

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.4, a missing comma in BLOCKED_PATTERNS concatenates the /lab and /api/terminals regular-expression literals. Requests to /api/terminals therefore bypass the anonymous endpoint blocklist and reach Jupyter Server's terminal API. An unauthenticated attacker can use the resulting interactive operating-system shell to execute commands and access data available to the Mercury process. This issue is fixed in version 3.2.4.

Exploitation Scenario

An attacker finds an internet-facing Mercury dashboard through Shodan or banner fingerprinting and confirms the version is between 3.0.0 and 3.2.3. They send an unauthenticated request to /api/terminals, which the broken blocklist lets through to Jupyter Server, and create a terminal session. They then connect to its WebSocket and gain an interactive shell. From there they dump environment variables for cloud and LLM API keys, copy datasets and model artifacts, and plant a reverse shell or modify a served notebook for persistence. They can then move laterally into the data platform or cloud account the host is trusted by.

Weaknesses (CWE)

CWE-185Incorrect Regular ExpressionPrimary CWE-185Incorrect Regular ExpressionPrimary CWE-284Improper Access ControlPrimary CWE-284Improper Access ControlPrimary CWE-185Incorrect Regular Expression CWE-284Improper Access Control

CWE-185 — Incorrect Regular Expression: The product specifies a regular expression in a way that causes data to be improperly matched or compared.

[Implementation] Regular expressions can become error prone when defining a complex language even for those experienced in writing grammars. Determine if several smaller regular expressions simplify one large regular expression. Also, subject the regular expression to thorough testing techniques such as equivalence partitioning, boundary value analysis, and robustness. After testing and a reasonable confidence level is achieved, a regular expression may not be foolproof. If an exploit is allowed to slip through, then record the exploit and refactor the regular expression.

Source: MITRE CWE corpus.