CVE-2026-75060: unauthenticated Jupyter MCP tools

CISO Take

JetBrains PyCharm versions before 2026.2.1 exposed Jupyter-related MCP (Model Context Protocol) tools without any authentication check, letting any local process or script invoke them directly and achieve arbitrary code execution on the developer's machine. This isn't a remote internet-facing bug (CVSS AV:L), but the combination of zero privileges required, zero user interaction, and full confidentiality/integrity/availability impact (CVSS 8.4, 3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) makes it trivially exploitable by anything already running on the developer's laptop — malware, a compromised browser tab reaching a local port, or a malicious VS Code/Jupyter extension. There's no EPSS score, no CISA KEV listing, and no public exploit or Nuclei template yet, so this is not being mass-exploited today, but developer workstations running PyCharm with AI/Jupyter integrations are high-value targets given the source code, cloud credentials, and API keys typically present. Patch to PyCharm 2026.2.1 or later immediately; until then, audit which local ports/sockets the Jupyter MCP integration binds to and restrict local process access, and treat any workstation running an older PyCharm with AI notebook features enabled as elevated risk in your asset inventory.

Sources: NVD jetbrains.com ATLAS

What is the risk?

High severity (CVSS 8.4) driven by complete loss of confidentiality, integrity, and availability with no authentication, no privileges, and no user interaction required. The attack vector is local, which caps remote internet-scale exploitation but does not meaningfully reduce risk in modern threat models where local code execution (malware, malicious browser content reaching localhost, supply-chain-compromised extensions, or another logged-in user/process) is a common initial foothold. No EPSS data, no CISA KEV listing, and no public exploit/scanner template exist yet, so near-term mass exploitation is unlikely — but the low complexity and lack of auth mean a working exploit would be trivial to develop once researchers focus on it. Missing authentication for a critical function (CWE-306) exposed via an AI agent tooling interface (MCP) is a novel and increasingly common failure pattern in IDE/AI-tool integrations.

How does the attack unfold?

Discovery

Local malicious code or process on the developer's machine discovers PyCharm's unauthenticated Jupyter MCP tool endpoint.

AML.T0084

Exploitation

The attacker invokes MCP tool calls directly against the endpoint without any authentication, triggering code execution in the Jupyter kernel.

AML.T0053

Impact

Arbitrary code runs with the privileges of the developer's PyCharm/Jupyter session, exposing source code, credentials, and enabling further pivoting.

AML.T0112.000

Discovery

Local malicious code or process on the developer's machine discovers PyCharm's unauthenticated Jupyter MCP tool endpoint.

AML.T0084

Exploitation

The attacker invokes MCP tool calls directly against the endpoint without any authentication, triggering code execution in the Jupyter kernel.

AML.T0053

Impact

Arbitrary code runs with the privileges of the developer's PyCharm/Jupyter session, exposing source code, credentials, and enabling further pivoting.

AML.T0112.000

How severe is it?

CVSS 3.1

8.4 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Local

AC Low

PR None

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

Upgrade to PyCharm 2026.2.1 or later, which fixes the missing authentication check on Jupyter MCP tools. Until patched, minimize exposure by disabling the Jupyter MCP/AI notebook integration if not actively used, and restrict which local applications or browser-reachable ports can interact with the IDE's local tool endpoints (e.g., host-based firewall rules on the loopback interface, or running the IDE in a locked-down/sandboxed profile). Detection: monitor for unexpected child processes spawned by PyCharm/Jupyter kernel processes, unusual local network connections to the IDE's MCP listener port, and unexpected code execution events in Jupyter kernel logs correlated with no interactive user action. Treat any workstation still on a pre-2026.2.1 PyCharm build with Jupyter/MCP enabled as a priority patch target.

How is it classified?

Code Execution Auth Bypass Agent Plugin AML.T0050 - Command and Scripting Interpreter AML.T0053 - AI Agent Tool Invocation AML.T0112.000 - Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

NIST AI RMF

MEASURE 2.7 - AI system security and resilience is evaluated and documented

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-75060?

JetBrains PyCharm versions before 2026.2.1 exposed Jupyter-related MCP (Model Context Protocol) tools without any authentication check, letting any local process or script invoke them directly and achieve arbitrary code execution on the developer's machine. This isn't a remote internet-facing bug (CVSS AV:L), but the combination of zero privileges required, zero user interaction, and full confidentiality/integrity/availability impact (CVSS 8.4, 3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) makes it trivially exploitable by anything already running on the developer's laptop — malware, a compromised browser tab reaching a local port, or a malicious VS Code/Jupyter extension. There's no EPSS score, no CISA KEV listing, and no public exploit or Nuclei template yet, so this is not being mass-exploited today, but developer workstations running PyCharm with AI/Jupyter integrations are high-value targets given the source code, cloud credentials, and API keys typically present. Patch to PyCharm 2026.2.1 or later immediately; until then, audit which local ports/sockets the Jupyter MCP integration binds to and restrict local process access, and treat any workstation running an older PyCharm with AI notebook features enabled as elevated risk in your asset inventory.

Is CVE-2026-75060 actively exploited?

No confirmed active exploitation of CVE-2026-75060 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-75060?

Upgrade to PyCharm 2026.2.1 or later, which fixes the missing authentication check on Jupyter MCP tools. Until patched, minimize exposure by disabling the Jupyter MCP/AI notebook integration if not actively used, and restrict which local applications or browser-reachable ports can interact with the IDE's local tool endpoints (e.g., host-based firewall rules on the loopback interface, or running the IDE in a locked-down/sandboxed profile). Detection: monitor for unexpected child processes spawned by PyCharm/Jupyter kernel processes, unusual local network connections to the IDE's MCP listener port, and unexpected code execution events in Jupyter kernel logs correlated with no interactive user action. Treat any workstation still on a pre-2026.2.1 PyCharm build with Jupyter/MCP enabled as a priority patch target.

What systems are affected by CVE-2026-75060?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, development/notebook environments.

What is the CVSS score for CVE-2026-75060?

CVE-2026-75060 has a CVSS v3.1 base score of 8.4 (HIGH).

What is the AI security impact?

Affected AI Architectures

agent frameworksdevelopment/notebook environments

MITRE ATLAS Techniques

AML.T0050 Command and Scripting Interpreter

AML.T0053 AI Agent Tool Invocation

AML.T0112.000 Local AI Agent

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

In JetBrains PyCharm before 2026.2.1 code execution was possible via unauthenticated Jupyter MCP tools

Exploitation Scenario

A developer has PyCharm open with the Jupyter MCP integration enabled while browsing the web or running third-party local tooling. Malicious code already present on the machine — delivered via a compromised npm/pip package, a malicious browser extension, or a webpage performing a local port scan/DNS rebinding attack — discovers the unauthenticated MCP tool endpoint on localhost. It sends crafted MCP tool-invocation requests to the Jupyter execution tool, which runs arbitrary Python code inside the developer's notebook kernel with no authentication prompt or user interaction. The attacker now has code execution in the context of the developer's IDE session, enabling theft of source code, API keys, cloud credentials, or use of the compromised workstation as a pivot point into the organization's build/CI environment.

Weaknesses (CWE)

CWE-306 Missing Authentication for Critical Function Primary CWE-306 Missing Authentication for Critical Function

CWE-306 — Missing Authentication for Critical Function: The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

[Architecture and Design] Divide the software into anonymous, normal, privileged, and administrative areas. Identify which of these areas require a proven user identity, and use a centralized authentication capability. Identify all potential communication channels, or other means of interaction with the software, to ensure that all channels are appropriately protected, including those channels that are assumed to be accessible only by authorized parties. Developers sometimes perform authentication at the primary channel, but open up a secondary channel that is assumed to be private. For example, a login mechanism may be listening on one network port, but after successful authentication, it may open up a second port where it waits for the connection, but avoids authentication because it assumes that only the authenticated party will connect to the port. In general, if the software or protocol allows a single session or user state to persist across multiple connections or channels, authentication and appropriate
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.