A vulnerability in jupyter-server versions 1.12.0 through 2.17.0 allows an attacker to bypass CORS origin validation when the `allow_origin_pat` configuration is used. The issue arises from the use of `re.match()` for validating the `Origin` header, which only anchors at the start of the string. This allows attacker-controlled domains such as `trusted.example.com.evil.com` to pass validation against patterns intended to match `trusted.example.com`. The vulnerability affects multiple locations in the codebase, including CORS headers, WebSocket connections, referer validation, and login redirects, potentially enabling phishing attacks, arbitrary code execution, and unauthorized access to sensitive API responses.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-dd1d19e58b advisory.

    New version fixing high-severity CVE.

    ----

    New version of jupyter-server fixing various security vulnerabilities.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-9536c7cb79 advisory.

    New version of jupyter-server fixing various security vulnerabilities.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A vulnerability in jupyter-server versions 1.12.0 through 2.17.0 allows an attacker to bypass CORS origin     validation when the `allow_origin_pat` configuration is used. The issue arises from the use of     `re.match()` for validating the `Origin` header, which only anchors at the start of the string. This     allows attacker-controlled domains such as `trusted.example.com.evil.com` to pass validation against     patterns intended to match `trusted.example.com`. The vulnerability affects multiple locations in the     codebase, including CORS headers, WebSocket connections, referer validation, and login redirects,     potentially enabling phishing attacks, arbitrary code execution, and unauthorized access to sensitive API     responses. (CVE-2026-6657)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
325143	Fedora 44 : python-jupyter-server (2026-dd1d19e58b)	Nessus	Fedora Local Security Checks	high
323134	Fedora 43 : python-jupyter-server (2026-9536c7cb79)	Nessus	Fedora Local Security Checks	high
318551	Linux Distros Unpatched Vulnerability : CVE-2026-6657	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-6657

high

Tenable Plugins

high

high

medium