CVE-2026-114135: Jupyter kernel execute authz bypass

Q: Is CVE-2026-114135 actively exploited?

No confirmed active exploitation of CVE-2026-114135 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-114135?

1) Upgrade jupyter_server to 2.6.0 or later. 2) Audit configuration and code for manual registration of jupyter_server.gateway.handlers and remove it, or apply the vendor fix for that path. 3) If patching is delayed, disable GatewayClient.url where it is not needed, or restrict access to Gateway-enabled servers to fully trusted users. 4) Network-isolate kernels and gateways, and give kernels least-privilege credentials with short-lived tokens. 5) Detect: review websocket connections to /api/kernels/*/channels from users whose Authorizer denies the execute action, and alert on unexpected kernel sessions or process spawns. 6) Rotate secrets that were accessible to kernels if unauthorized access is suspected.

Q: What systems are affected by CVE-2026-114135?

This vulnerability affects the following AI/ML architecture patterns: Notebook and data science platforms, Remote kernel gateways, Training pipelines, Multi-tenant ML development environments.

Q: What is the CVSS score for CVE-2026-114135?

CVE-2026-114135 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.48%.

CISO Take

Jupyter Server 2.0.0 through 2.5.x, when GatewayClient.url is enabled, authenticates users but skips the authorizer check for kernel execution (CWE-862), so a low-privileged user can run code on a kernel even though the configured Authorizer denies it. This is rated high (CVSS 8.8, network, low complexity, no user interaction), and kernel access exposes data, credentials and cloud tokens available to notebook environments that often sit next to training data and model artifacts. There is no EPSS score, no KEV listing, no public exploit and no Nuclei template, so mass exploitation is not currently evidenced, but the flaw is trivial to use for any authenticated insider or tenant. Upgrade to jupyter_server 2.6.0 or later, and make sure no deployment manually registers the deprecated jupyter_server.gateway.handlers module, since that path remains bypassable even in 2.6.0+. Until patched, restrict Gateway-enabled servers to fully trusted users and review kernel session activity.

Sources:NVDGitHub AdvisoryATLAS

What is the risk?

High. Exploitation requires only a low-privileged authenticated account and no user interaction, and the network-reachable attack path has low complexity. The affected setup is limited to deployments that use GatewayClient.url with a restricted Authorizer (for example multi-user or shared notebook platforms), which narrows exposure but concentrates it where isolation is expected. No exploitation in the wild, KEV listing or public PoC is known, and EPSS data is unavailable. The residual bypass via the deprecated gateway handlers module means that upgrading alone may not close the gap for some configurations.

How does the attack unfold?

Initial Access

Attacker authenticates with a low-privileged account on a Jupyter Server that has GatewayClient.url enabled.

AML.T0012

Authorization Bypass

The attacker opens a kernel channel websocket, and the handler skips the Authorizer check for the kernel execute action.

AML.T0049

Code Execution

The attacker runs arbitrary code in the upstream kernel despite the policy denying it.

AML.T0050

Impact

The attacker steals data and credentials from the kernel environment and can modify or disrupt notebooks and pipelines.

AML.T0055

Initial Access

Attacker authenticates with a low-privileged account on a Jupyter Server that has GatewayClient.url enabled.

AML.T0012

Authorization Bypass

The attacker opens a kernel channel websocket, and the handler skips the Authorizer check for the kernel execute action.

AML.T0049

Code Execution

The attacker runs arbitrary code in the upstream kernel despite the policy denying it.

AML.T0050

Impact

The attacker steals data and credentials from the kernel environment and can modify or disrupt notebooks and pipelines.

AML.T0055

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Jupyter	pip	—	No patch
13.5KOpenSSF 5.81.9K dependentsPushed 11d ago58% patched~28d to patchFull package profile →
Jupyter	pip	>= 2.0.0, < 2.6.0	`2.6.0`
13.5KOpenSSF 5.81.9K dependentsPushed 11d ago58% patched~28d to patchFull package profile →

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 42% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade jupyter_server to 2.6.0 or later. 2) Audit configuration and code for manual registration of jupyter_server.gateway.handlers and remove it, or apply the vendor fix for that path. 3) If patching is delayed, disable GatewayClient.url where it is not needed, or restrict access to Gateway-enabled servers to fully trusted users. 4) Network-isolate kernels and gateways, and give kernels least-privilege credentials with short-lived tokens. 5) Detect: review websocket connections to /api/kernels/*/channels from users whose Authorizer denies the execute action, and alert on unexpected kernel sessions or process spawns. 6) Rotate secrets that were accessible to kernels if unauthorized access is suspected.

How is it classified?

Auth BypassCode ExecutionData LeakageFrameworkTraining DataAML.T0012- Valid Accounts AML.T0037- Data from Local System AML.T0050- Command and Scripting Interpreter AML.T0055- Unsecured Credentials

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Respond to previously unknown risks and manage identified risks

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-114135?

Jupyter Server 2.0.0 through 2.5.x, when GatewayClient.url is enabled, authenticates users but skips the authorizer check for kernel execution (CWE-862), so a low-privileged user can run code on a kernel even though the configured Authorizer denies it. This is rated high (CVSS 8.8, network, low complexity, no user interaction), and kernel access exposes data, credentials and cloud tokens available to notebook environments that often sit next to training data and model artifacts. There is no EPSS score, no KEV listing, no public exploit and no Nuclei template, so mass exploitation is not currently evidenced, but the flaw is trivial to use for any authenticated insider or tenant. Upgrade to jupyter_server 2.6.0 or later, and make sure no deployment manually registers the deprecated jupyter_server.gateway.handlers module, since that path remains bypassable even in 2.6.0+. Until patched, restrict Gateway-enabled servers to fully trusted users and review kernel session activity.

Is CVE-2026-114135 actively exploited?

No confirmed active exploitation of CVE-2026-114135 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-114135?

1) Upgrade jupyter_server to 2.6.0 or later. 2) Audit configuration and code for manual registration of jupyter_server.gateway.handlers and remove it, or apply the vendor fix for that path. 3) If patching is delayed, disable GatewayClient.url where it is not needed, or restrict access to Gateway-enabled servers to fully trusted users. 4) Network-isolate kernels and gateways, and give kernels least-privilege credentials with short-lived tokens. 5) Detect: review websocket connections to /api/kernels/*/channels from users whose Authorizer denies the execute action, and alert on unexpected kernel sessions or process spawns. 6) Rotate secrets that were accessible to kernels if unauthorized access is suspected.

What systems are affected by CVE-2026-114135?

This vulnerability affects the following AI/ML architecture patterns: Notebook and data science platforms, Remote kernel gateways, Training pipelines, Multi-tenant ML development environments.

What is the CVSS score for CVE-2026-114135?

CVE-2026-114135 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.48%.

What is the AI security impact?

Affected AI Architectures

Notebook and data science platformsRemote kernel gatewaysTraining pipelinesMulti-tenant ML development environments

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0037Data from Local System

AML.T0050Command and Scripting Interpreter

AML.T0055Unsecured Credentials

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

Jupyter Server is the backend for Jupyter web applications. From 2.0.0 until 2.6.0, enabling GatewayClient.url replaced the normal KernelWebsocketHandler with WebSocketChannelsHandler, which authenticated the user but did not call authorizer.is_authorized(...) for the execute action on the kernels resource. A restricted authenticated user could therefore open an upstream kernel channel and obtain kernel execution despite the configured Authorizer denying that action, exposing data and credentials available to the kernel and permitting modification or disruption of the kernel environment. The default gateway configuration is fixed in version 2.6.0. In 2.6.0 and later, the same authorization bypass remains possible when a deployment manually registers the deprecated jupyter_server.gateway.handlers module, because its handler still omits the configured kernel-execute authorization decision.

Exploitation Scenario

An analyst account on a shared data science platform is restricted by the Authorizer to read-only notebook viewing. The platform uses a kernel gateway through GatewayClient.url. The user opens a websocket to an existing kernel channel, which authenticates but never checks the execute permission. They send execute requests that read environment variables and mounted credentials, copy proprietary datasets and model files from the kernel's storage, and use the stolen cloud tokens to pivot into the ML infrastructure. They could also alter or crash the kernel to tamper with running training jobs.

Weaknesses (CWE)

CWE-862Missing AuthorizationPrimary CWE-862Missing AuthorizationPrimary CWE-862Missing Authorization

CWE-862 — Missing Authorization: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.