CVE-2026-54528: Jupyter excluded_paths bypass exposes

Q: Is CVE-2026-54528 actively exploited?

No confirmed active exploitation of CVE-2026-54528 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-54528?

1. Patch: Upgrade jupyterlab-git to 0.54.0 which replaces fnmatch.fnmatchcase() with case-normalized matching. 2. If patching is delayed, do not treat excluded_paths as a security boundary — move all sensitive files out of git-tracked directories entirely and use .gitignore to prevent future commits. 3. Rotate all credentials stored in excluded directories; assume they were readable since deployment of 0.53.0. 4. Purge secrets from git history using git filter-repo, since the attack exposes all historical commits not just HEAD. 5. Detection: audit web server access logs for POST requests to /git/*/content or /git/*/status where path segments differ in case from known excluded patterns. 6. Defense in depth: enforce secret scanning (e.g., truffleHog, gitleaks) at commit time so credentials never enter git history.

Q: What systems are affected by CVE-2026-54528?

This vulnerability affects the following AI/ML architecture patterns: ML development environments, Data science platforms, Training pipelines.

Q: What is the CVSS score for CVE-2026-54528?

CVE-2026-54528 has a CVSS v3.1 base score of 7.1 (HIGH). The EPSS exploitation probability is 0.35%.

CISO Take

jupyterlab-git 0.53.0 uses a case-sensitive pattern matcher to enforce admin-configured path exclusions, allowing any authenticated user on macOS (APFS) or Windows (NTFS) servers to read git-tracked files from protected directories by simply varying the URL path case — e.g., POST to `/git/project/Secrets/content` bypasses a rule blocking `/git/project/secrets`. With 1,874 downstream dependents and a fully working public PoC requiring zero specialized knowledge, any multi-tenant JupyterLab or JupyterHub deployment where credentials directories were treated as protected must be considered at risk today. The vulnerability carries no CISA KEV listing and no EPSS score yet, but the trivial exploitation barrier (change a letter's case in the URL) means any authenticated insider or compromised notebook session can exfiltrate secrets — including historical commits in git. Patch to jupyterlab-git 0.54.0 immediately; as a temporary workaround, remove all sensitive files from git-tracked excluded directories and rotate any credentials that may have been committed.

Sources: NVD GitHub Advisory ATLAS OpenSSF

What is the risk?

High risk in shared JupyterLab and JupyterHub environments. Exploitation requires only a valid session token and a single HTTP request with a case-varied path — no AI/ML knowledge, no special tooling. On single-user local installations the attack surface is negligible; in enterprise ML platforms with multiple authenticated users, any one of them can pivot to read git-tracked secrets supposedly protected by excluded_paths. The 23 prior CVEs in this package signal persistent security debt. The OpenSSF Scorecard of 5.8/10 suggests limited secure-development practices. No active exploitation reported, but the public PoC lowers the barrier to near zero.

How does the attack unfold?

Reconnaissance

Authenticated user probes the jupyterlab-git HTTP API and observes that POST to /git/project/secrets/status returns HTTP 404, revealing that /project/secrets is an admin-excluded path.

AML.T0006

Exploitation

Attacker crafts a case-varied URL (/git/project/Secrets/status) that passes the fnmatchcase check because the pattern comparison is unconditionally case-sensitive, receiving HTTP 200 on the same underlying filesystem directory.

AML.T0049

Collection

Attacker enumerates files in the excluded directory via the /status and /log endpoints, identifying credential files and walking git history to find deleted secrets in prior commits.

AML.T0037

Exfiltration

Attacker reads credential file content via POST /git/project/Secrets/content with specific filename and git ref parameters, exfiltrating API keys, model registry tokens, or cloud credentials over HTTP.

AML.T0025

Reconnaissance

Authenticated user probes the jupyterlab-git HTTP API and observes that POST to /git/project/secrets/status returns HTTP 404, revealing that /project/secrets is an admin-excluded path.

AML.T0006

Exploitation

Attacker crafts a case-varied URL (/git/project/Secrets/status) that passes the fnmatchcase check because the pattern comparison is unconditionally case-sensitive, receiving HTTP 200 on the same underlying filesystem directory.

AML.T0049

Collection

Attacker enumerates files in the excluded directory via the /status and /log endpoints, identifying credential files and walking git history to find deleted secrets in prior commits.

AML.T0037

Exfiltration

Attacker reads credential file content via POST /git/project/Secrets/content with specific filename and git ref parameters, exfiltrating API keys, model registry tokens, or cloud credentials over HTTP.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Jupyter	pip	<= 0.53.0	`0.54.0`
13.3K OpenSSF 5.8 1.9K dependents Pushed 6d ago 56% patched ~28d to patch Full package profile →

Do you use Jupyter? You're affected.

How severe is it?

CVSS 3.1

7.1 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 28% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I Low

A None

What should I do?

6 steps

Patch: Upgrade jupyterlab-git to 0.54.0 which replaces fnmatch.fnmatchcase() with case-normalized matching.
If patching is delayed, do not treat excluded_paths as a security boundary — move all sensitive files out of git-tracked directories entirely and use .gitignore to prevent future commits.
Rotate all credentials stored in excluded directories; assume they were readable since deployment of 0.53.0.
Purge secrets from git history using git filter-repo, since the attack exposes all historical commits not just HEAD.
Detection: audit web server access logs for POST requests to /git/*/content or /git/*/status where path segments differ in case from known excluded patterns.
Defense in depth: enforce secret scanning (e.g., truffleHog, gitleaks) at commit time so credentials never enter git history.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Extraction Framework Plugin AML.T0025 - Exfiltration via Cyber Means AML.T0037 - Data from Local System AML.T0049 - Exploit Public-Facing Application AML.T0055 - Unsecured Credentials AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2 - AI system access control

NIST AI RMF

GOVERN 6.1 - Policies and procedures for AI risk management MANAGE 2.2 - Mechanisms for AI risk response and recovery

OWASP LLM Top 10

LLM03:2025 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2026-54528?

jupyterlab-git 0.53.0 uses a case-sensitive pattern matcher to enforce admin-configured path exclusions, allowing any authenticated user on macOS (APFS) or Windows (NTFS) servers to read git-tracked files from protected directories by simply varying the URL path case — e.g., POST to `/git/project/Secrets/content` bypasses a rule blocking `/git/project/secrets`. With 1,874 downstream dependents and a fully working public PoC requiring zero specialized knowledge, any multi-tenant JupyterLab or JupyterHub deployment where credentials directories were treated as protected must be considered at risk today. The vulnerability carries no CISA KEV listing and no EPSS score yet, but the trivial exploitation barrier (change a letter's case in the URL) means any authenticated insider or compromised notebook session can exfiltrate secrets — including historical commits in git. Patch to jupyterlab-git 0.54.0 immediately; as a temporary workaround, remove all sensitive files from git-tracked excluded directories and rotate any credentials that may have been committed.

Is CVE-2026-54528 actively exploited?

No confirmed active exploitation of CVE-2026-54528 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-54528?

1. Patch: Upgrade jupyterlab-git to 0.54.0 which replaces fnmatch.fnmatchcase() with case-normalized matching. 2. If patching is delayed, do not treat excluded_paths as a security boundary — move all sensitive files out of git-tracked directories entirely and use .gitignore to prevent future commits. 3. Rotate all credentials stored in excluded directories; assume they were readable since deployment of 0.53.0. 4. Purge secrets from git history using git filter-repo, since the attack exposes all historical commits not just HEAD. 5. Detection: audit web server access logs for POST requests to /git/*/content or /git/*/status where path segments differ in case from known excluded patterns. 6. Defense in depth: enforce secret scanning (e.g., truffleHog, gitleaks) at commit time so credentials never enter git history.

What systems are affected by CVE-2026-54528?

This vulnerability affects the following AI/ML architecture patterns: ML development environments, Data science platforms, Training pipelines.

What is the CVSS score for CVE-2026-54528?

CVE-2026-54528 has a CVSS v3.1 base score of 7.1 (HIGH). The EPSS exploitation probability is 0.35%.

What is the AI security impact?

Affected AI Architectures

ML development environmentsData science platformsTraining pipelines

MITRE ATLAS Techniques

AML.T0025 Exfiltration via Cyber Means

AML.T0037 Data from Local System

AML.T0049 Exploit Public-Facing Application

AML.T0055 Unsecured Credentials

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2

NIST AI RMF: GOVERN 6.1, MANAGE 2.2

OWASP LLM Top 10: LLM03:2025

What are the technical details?

Original Advisory

JupyterLab Git is a Git extension for JupyterLab. Prior to 0.54.0, jupyterlab-git uses fnmatch.fnmatchcase() in GitHandler.prepare() in jupyterlab_git/handlers.py to enforce excluded_paths, allowing an authenticated user on a case-insensitive filesystem to vary URL path casing and read excluded directories. This issue is fixed in version 0.54.0.

Exploitation Scenario

A data scientist on a shared JupyterHub instance sends POST /git/project/secrets/status and receives HTTP 404, revealing that /project/secrets is an excluded path. They then send POST /git/project/Secrets/status with their session Bearer token and receive HTTP 200. They enumerate target files via the /status and /log endpoints, then exfiltrate an MLflow tracking server API key by requesting POST /git/project/Secrets/content with body {"filename": "./mlflow_creds.txt", "reference": {"git": "HEAD"}}. They walk git history to recover credentials that were rotated months ago by querying earlier commit SHAs. The entire chain requires only curl and an authenticated session cookie obtained from their own valid JupyterLab login.

Weaknesses (CWE)

CWE-178 Improper Handling of Case Sensitivity Primary CWE-178 Improper Handling of Case Sensitivity Primary CWE-178 Improper Handling of Case Sensitivity

CWE-178 — Improper Handling of Case Sensitivity: The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.

[Architecture and Design] Avoid making decisions based on names of resources (e.g. files) if those resources can have alternate names.
[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis

Source: MITRE CWE corpus.