CVE-2026-111058: Mercury: missing auth allows anonymous kernel RCE

Q: Is CVE-2026-111058 actively exploited?

No confirmed active exploitation of CVE-2026-111058 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-111058?

1) Upgrade mercury to 3.2.6 or later (pip install -U mercury). 2) Until patched, do not expose Mercury to the Internet; restrict access with a VPN, network ACLs, or an authenticating reverse proxy that covers /api/kernels and the websocket endpoints. 3) Enable authentication and avoid tokenless defaults. 4) Run Mercury as an unprivileged user in a container with minimal secrets, egress filtering, and no access to production credentials. 5) Detection: look in web and proxy logs for unauthenticated requests to /api/kernels and websocket connections from unknown sources, list running Jupyter kernels for unexpected ones, and monitor for unusual child processes, outbound connections, or file changes on the host. 6) If an exposed instance was running a vulnerable version, assume compromise and rotate any secrets, tokens, and cloud keys reachable from that host.

Q: What systems are affected by CVE-2026-111058?

This vulnerability affects the following AI/ML architecture patterns: Notebook-based dashboards, Data science and ML workbenches, Model serving and experimentation environments, ML development pipelines.

Q: What is the CVSS score for CVE-2026-111058?

CVE-2026-111058 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.52%.

GHSA-rv4m-xm3f-3ccqCRITICALCISA: TRACK*

Published October 19, 2026

CISO Take

Mercury, a framework that publishes Jupyter notebooks as web apps, ships in its default tokenless configuration with no authorization on the kernel API, so any anonymous network client can create a Jupyter kernel and run arbitrary Python on the host (CVSS 9.8, CWE-862). The package has 3,043 downstream dependents, and the advisory shows a 72-CVE history and an OpenSSF Scorecard of 5.8/10, which points to a project with a weak security track record. Exploitation likelihood is currently modest (EPSS 0.44%, 63rd percentile, not in CISA KEV, no public exploit or Nuclei template), but the attack needs no credentials and is trivial to script, so this status could change quickly once the advisory is widely read. Upgrade to Mercury 3.2.6 immediately, and until then take any Internet-reachable instance offline or put it behind an authenticating reverse proxy or VPN. Review exposed instances for unexpected kernels and unusual outbound connections.

Sources:NVDEPSSGitHub AdvisoryOpenSSFATLAS

What is the risk?

High to critical for any Mercury deployment reachable from untrusted networks. The flaw is network-exploitable, requires no privileges or user interaction, and gives arbitrary code execution with the privileges of the Mercury process. Current exploitation indicators are low (EPSS 0.00437, no KEV listing, no public exploit, no scanner template), so the near-term risk is driven by ease of exploitation rather than observed attacks. The risk is highest for default tokenless deployments and for instances placed on the Internet to share dashboards. Internal-only deployments still face lateral-movement risk from any compromised host on the network.

How does the attack unfold?

Initial Access

Attacker finds an exposed Mercury instance running in the default tokenless mode and reaches the kernel API without authentication.

AML.T0049

Execution

Attacker creates a kernel via /api/kernels and sends an execute_request message with arbitrary Python over the websocket.

AML.T0050

Collection

Injected code harvests credentials, environment variables, model files, and datasets from the notebook host.

AML.T0037

Impact

Attacker uses the stolen secrets to pivot into ML infrastructure, exfiltrate data, or tamper with models and dashboards.

Initial Access

Attacker finds an exposed Mercury instance running in the default tokenless mode and reaches the kernel API without authentication.

AML.T0049

Execution

Attacker creates a kernel via /api/kernels and sends an execute_request message with arbitrary Python over the websocket.

AML.T0050

Collection

Injected code harvests credentials, environment variables, model files, and datasets from the notebook host.

AML.T0037

Impact

Attacker uses the stolen secrets to pivot into ML infrastructure, exfiltrate data, or tamper with models and dashboards.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Jupyter Notebook	pip	<= 3.2.5	`3.2.6`
13.5KOpenSSF 5.83.0K dependentsPushed 11d ago79% patched~75d to patchFull package profile →

Do you use Jupyter Notebook? You're affected.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 44% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade mercury to 3.2.6 or later (pip install -U mercury). 2) Until patched, do not expose Mercury to the Internet; restrict access with a VPN, network ACLs, or an authenticating reverse proxy that covers /api/kernels and the websocket endpoints. 3) Enable authentication and avoid tokenless defaults. 4) Run Mercury as an unprivileged user in a container with minimal secrets, egress filtering, and no access to production credentials. 5) Detection: look in web and proxy logs for unauthenticated requests to /api/kernels and websocket connections from unknown sources, list running Jupyter kernels for unexpected ones, and monitor for unusual child processes, outbound connections, or file changes on the host. 6) If an exposed instance was running a vulnerable version, assume compromise and rotate any secrets, tokens, and cloud keys reachable from that host.

What does CISA's SSVC say?

DecisionTrack*

Exploitationnone

AutomatableYes

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassCode ExecutionFrameworkAML.T0035- AI Artifact Collection AML.T0037- Data from Local System AML.T0049- Exploit Public-Facing Application AML.T0050- Command and Scripting Interpreter

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Procedures to respond to and recover from unknown risks

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-111058?

Is CVE-2026-111058 actively exploited?

No confirmed active exploitation of CVE-2026-111058 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-111058?

1) Upgrade mercury to 3.2.6 or later (pip install -U mercury). 2) Until patched, do not expose Mercury to the Internet; restrict access with a VPN, network ACLs, or an authenticating reverse proxy that covers /api/kernels and the websocket endpoints. 3) Enable authentication and avoid tokenless defaults. 4) Run Mercury as an unprivileged user in a container with minimal secrets, egress filtering, and no access to production credentials. 5) Detection: look in web and proxy logs for unauthenticated requests to /api/kernels and websocket connections from unknown sources, list running Jupyter kernels for unexpected ones, and monitor for unusual child processes, outbound connections, or file changes on the host. 6) If an exposed instance was running a vulnerable version, assume compromise and rotate any secrets, tokens, and cloud keys reachable from that host.

What systems are affected by CVE-2026-111058?

This vulnerability affects the following AI/ML architecture patterns: Notebook-based dashboards, Data science and ML workbenches, Model serving and experimentation environments, ML development pipelines.

What is the CVSS score for CVE-2026-111058?

CVE-2026-111058 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.52%.

What is the AI security impact?

Affected AI Architectures

Notebook-based dashboardsData science and ML workbenchesModel serving and experimentation environmentsML development pipelines

MITRE ATLAS Techniques

AML.T0035AI Artifact Collection

AML.T0037Data from Local System

AML.T0049Exploit Public-Facing Application

AML.T0050Command and Scripting Interpreter

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. Prior to 3.2.6, default tokenless deployments allow anonymous clients to create Jupyter kernels and send execute_request messages containing arbitrary Python. The endpoint blocklist does not cover /api/kernels, and the websocket wrapper previously tracked idle activity without authorizing executable messages. This issue is fixed in version 3.2.6.

Exploitation Scenario

An attacker scans for Internet-facing Mercury instances, for example by identifying the Mercury web UI. They send an unauthenticated POST to /api/kernels to create a kernel, then open a websocket to that kernel and send an execute_request message containing Python code. The code reads environment variables and cloud credentials, copies model files and datasets, and opens a reverse shell. From the data science host, the attacker moves to the model registry, feature store, or cloud storage, or tampers with the notebooks and models that downstream users and pipelines consume.

Weaknesses (CWE)

CWE-862Missing AuthorizationPrimary CWE-862Missing Authorization CWE-862Missing Authorization

CWE-862 — Missing Authorization: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.