CVE-2026-86044: JupyterLab Desktop: open redirect leaks token, enables RCE

CRITICAL

Published November 6, 2026

CISO Take

JupyterLab Desktop before 4.6.2-1 exposes its local server URL and auth token to any page the app window navigates to. An attacker can chain that with a crafted MathJax link in an untrusted notebook (JupyterLab before 4.4.8) to run arbitrary code as the victim. The CVSS is 9.6, but exploitation needs the victim to open a hostile notebook and click a link. There is no EPSS data, no KEV listing, no public exploit and no Nuclei template, so there is no evidence of active exploitation yet. Data scientists routinely open notebooks from the internet, which makes the lure realistic, and their workstations often hold cloud credentials, datasets and model artifacts. Upgrade JupyterLab Desktop to 4.6.2-1 or later, make sure the bundled JupyterLab is 4.4.8 or later, and tell users not to open untrusted notebooks until they have patched.

Sources:NVDGitHub AdvisoryATLAS

What is the risk?

Severity is critical (CVSS 9.6, scope changed), but real-world likelihood is moderate. The attacker needs the victim to open a malicious notebook and click an embedded link, and the full chain only works in a locally managed session with JupyterLab before 4.4.8. Once triggered, the attack is low complexity and needs no privileges. It gives full code execution as the user, with high confidentiality, integrity and availability impact. EPSS is not available, there is no KEV listing, and there is no public PoC or scanner template. Exposure is limited to desktop endpoints, not servers.

How does the attack unfold?

Initial Access

The victim receives and opens an untrusted notebook containing a crafted MathJax link.

AML.T0011.003

Redirect

The victim clicks the link and the desktop renderer navigates to an attacker-controlled site while keeping the preload bridge.

AML.T0078

Credential Theft

The attacker's page calls getServerInfo to obtain the local Jupyter server URL and authentication token.

AML.T0091.000

Code Execution and Impact

The attacker uses the Jupyter REST API to create and trust a notebook that runs arbitrary code, exposing data, credentials and models on the host.

AML.T0050

Initial Access

The victim receives and opens an untrusted notebook containing a crafted MathJax link.

AML.T0011.003

Redirect

The victim clicks the link and the desktop renderer navigates to an attacker-controlled site while keeping the preload bridge.

AML.T0078

Credential Theft

The attacker's page calls getServerInfo to obtain the local Jupyter server URL and authentication token.

AML.T0091.000

Code Execution and Impact

The attacker uses the Jupyter REST API to create and trust a notebook that runs arbitrary code, exposing data, credentials and models on the host.

AML.T0050

How severe is it?

CVSS 3.1

9.6 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACLow

PRNone

UIRequired

SChanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade JupyterLab Desktop to 4.6.2-1 or later (release v4.6.2-1, commit 7f8f64ae). 2) Make sure the bundled or managed JupyterLab is 4.4.8 or later. 3) Do not open or trust notebooks from unknown sources; open them in an isolated VM or container, or view them statically with nbviewer or nbconvert. 4) Rotate any Jupyter tokens and cloud or API credentials that were present on machines that opened suspicious notebooks. 5) Detect: look for unexpected notebook creation and trust operations through the Jupyter REST API (/api/contents, /api/kernels, /api/sessions), unusual child processes of the Jupyter server or the Electron app, and outbound connections from the JupyterLab Desktop process to unfamiliar domains. 6) Inventory installed JupyterLab Desktop versions through endpoint management and block versions below 4.6.2-1.

How is it classified?

Code ExecutionSocial EngineeringData LeakageFrameworkAML.T0011.003- Malicious Link AML.T0050- Command and Scripting Interpreter AML.T0078- Drive-by Compromise AML.T0091.000- Application Access Token AML.T0112.000- Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.10.3-Suppliers

NIST AI RMF

MANAGE 3.1-Third-party resources risk management

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-86044?

Is CVE-2026-86044 actively exploited?

No confirmed active exploitation of CVE-2026-86044 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-86044?

1) Upgrade JupyterLab Desktop to 4.6.2-1 or later (release v4.6.2-1, commit 7f8f64ae). 2) Make sure the bundled or managed JupyterLab is 4.4.8 or later. 3) Do not open or trust notebooks from unknown sources; open them in an isolated VM or container, or view them statically with nbviewer or nbconvert. 4) Rotate any Jupyter tokens and cloud or API credentials that were present on machines that opened suspicious notebooks. 5) Detect: look for unexpected notebook creation and trust operations through the Jupyter REST API (/api/contents, /api/kernels, /api/sessions), unusual child processes of the Jupyter server or the Electron app, and outbound connections from the JupyterLab Desktop process to unfamiliar domains. 6) Inventory installed JupyterLab Desktop versions through endpoint management and block versions below 4.6.2-1.

What systems are affected by CVE-2026-86044?

This vulnerability affects the following AI/ML architecture patterns: Interactive notebook environments, Data science workstations, Training pipelines, Local ML development environments.

What is the CVSS score for CVE-2026-86044?

CVE-2026-86044 has a CVSS v3.1 base score of 9.6 (CRITICAL).

What is the AI security impact?

Affected AI Architectures

Interactive notebook environmentsData science workstationsTraining pipelinesLocal ML development environments

MITRE ATLAS Techniques

AML.T0011.003Malicious Link

AML.T0050Command and Scripting Interpreter

AML.T0078Drive-by Compromise

AML.T0091.000Application Access Token

AML.T0112.000Local AI Agent

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.10.3

NIST AI RMF: MANAGE 3.1

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, JupyterLab Desktop exposed getServerInfo to the renderer without confirming that the current page still had the local Jupyter server origin. In a local managed session using JupyterLab before 4.4.8, an attacker can place a crafted MathJax link in an untrusted notebook. If a victim opens the notebook and clicks the link, the existing renderer navigates to an attacker-controlled site while retaining access to the preload bridge. The site can call getServerInfo to obtain the local server URL and authentication token, then use the Jupyter REST API to create and trust a notebook that executes arbitrary code as the victim. Users whose environment already uses JupyterLab 4.4.8 or later are unaffected because the corrected link handling breaks the first step of the chain. This vulnerability is fixed in 4.6.2-1.

Exploitation Scenario

An attacker publishes a polished notebook on GitHub, Kaggle or a shared drive, or emails it to a data scientist as a 'reproducible research' file. The notebook contains a crafted MathJax link. When the victim opens it in JupyterLab Desktop (with JupyterLab before 4.4.8) and clicks the link, the app window navigates to the attacker's site while keeping its preload bridge. The site calls getServerInfo to obtain the local server URL and token. It then uses the Jupyter REST API to create and trust a new notebook that runs code on the workstation. The attacker steals cloud and LLM API keys and datasets and installs persistence on the machine.

Weaknesses (CWE)

CWE-601URL Redirection to Untrusted SitePrimary CWE-601URL Redirection to Untrusted Site

CWE-601 — URL Redirection to Untrusted Site: The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] Use an intermediate disclaimer page that provides the user with a clear warning that they are leaving the current site. Implement a long timeout before the redirect occurs, or force the user to click on the link. Be careful to avoid XSS problems (CWE-79) when generating the disclaimer page.

Source: MITRE CWE corpus.