Jupyter Server gateway WebSocket handler bypasses kernel execute authorization

What's on the official record

The OSV advisory GHSA-354v-3q48-cv69 reports a HIGH-severity vulnerability in the PyPI package jupyter-server, alias CVE-2026-114135, CWE-862. Jupyter Server's gateway WebSocket handler checks that a user is authenticated, but it does not ask the configured Authorizer whether that user may execute kernels. The affected range is Jupyter Server 2.0.0 through 2.5.0, and the advisory names 2.6.0 as the fixed version. The record ties the condition to deployments where GatewayClient.url is enabled.

Assessment

For a platform or AI-stack owner, the record gives a concrete check: whether a deployed Jupyter Server sits in the affected 2.0.0–2.5.0 range and has GatewayClient.url enabled, in which case the gateway WebSocket path can reach kernel execution without the configured Authorizer's approval. The decision is to patch to 2.6.0 or isolate the gateway until the upgrade lands.

For a deal team (a buyer or investor), the advisory is a diligence item on any target that runs Jupyter Server as part of its ML platform. The record lets the team ask whether the target's pinned version is below 2.6.0 and whether gateway mode is in use, and to condition or price accordingly.

What would change this call

A revision to the advisory that widens or narrows the affected range, or a change to the fixed version, would change the patch target. Evidence that the bypass is reachable without GatewayClient.url enabled would broaden the exposure beyond the stated condition.

What to check next

Confidence

The record is the OSV advisory itself, attributed to GitHub's advisory database. Filed 23 October 2026 from the record dated 22 October 2026. FIRST's EPSS estimate for CVE-2026-114135 is 0.004 (p32, 2026-10-23); the record does not state observed exploitation.

Sources

[1] Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorization — https://github.com/advisories/GHSA-354v-3q48-cv69