---
id: "CVE-2026-114135"
kind: "vulnerability"
aliases: ["CVE-2026-114135", "GHSA-354v-3q48-cv69"]
title: "Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorization"
severity: "high"
cvss: 8.800000190734863
epss: 0.003860000055283308
exploited: false
status: "open"
category: "package"
products: [{"name": "jupyter-server", "fixed": ["2.6.0"], "affected": ">= 2.0.0, < 2.6.0", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["cwe-862", "enterprise-gateway", "jupyter-gateway", "jupyter-server", "jupyterhub", "package", "python"]
not_affected_if: ["default-config", "jupyter-server-below-2.0.0-or-at-least-2.6.0-without-deprecated-handler", "no-custom-authorizer", "no-gateway-client-url"]
published_at: "2026-10-21T20:17:25+00:00"
first_seen_at: "2026-10-23T19:11:32+00:00"
updated_at: "2026-10-23T21:57:29+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-354v-3q48-cv69", "first_seen_at": "2026-10-23T19:11:32+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114135", "first_seen_at": "2026-10-23T21:57:29+00:00"}]
---

# Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorization

Jupyter Server's gateway WebSocket handler checks only that a user is logged in and never asks the configured Authorizer whether that user may execute kernels. An authenticated user denied kernel execute rights can still open a kernel channel through the gateway and run code on the upstream kernel, with access to that kernel's data and credentials.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:jupyter-server affected >= 2.0.0, < 2.6.0 fixed 2.6.0

## How to check

Check whether GatewayClient.url is set in the Jupyter Server config and run pip show jupyter-server to get the installed version.
Search your config for a custom Authorizer and for any import of jupyter_server.gateway.handlers.

## Fix

Upgrade jupyter-server to 2.6.0 or later.
If you register the deprecated jupyter_server.gateway.handlers module manually, remove that registration; the sources say it still exposes the old behavior in 2.6.0 and later.

## Timeline

- 2026-10-23T19:11:32+00:00 ghsa https://github.com/advisories/GHSA-354v-3q48-cv69
- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114135

## From the sources

### Summary

Jupyter Server's gateway WebSocket handler checks that a user is authenticated, but it does not ask the configured Authorizer whether that user may execute kernels.

In Jupyter Server 2.0.0 through 2.5.0, enabling GatewayClient.url automatically replaced the normal kernel channel handler with this gateway-specific handler. An authenticated user who is denied the `execute` action on the `kernels` resource can therefore still open a kernel channel and send messages to the upstream kernel.

### Details

The normal handler performs the expected authorization check before creating the WebSocket connection:

https://github.com/jupyter-server/jupyter_server/blob/v2.5.0/jupyter_server/services/kernels/websocket.py#L39-L47

The gateway handler only checks `current_user` and then opens the upstream channel. It never calls `authorizer.is_authorized(...)`:

https://github.com/jupyter-server/jupyter_server/blob/v2.5.0/jupyter_server/gateway/handlers.py#L49-L75
https://github.com/jupyter-server/jupyter_server/blob/v2.5.0/jupyter_server/gateway/handlers.py#L87-L98

Gateway mode selected that handler automatically by replacing handlers with matching routes:

https://github.com/jupyter-server/jupyter_server/blob/v2.5.0/jupyter_server/serverapp.py#L437-L446

PR #1261 stopped replacing the normal handler and routed gateway traffic through `GatewayWebSocketConnection` instead. This appears to have fixed the default gateway configuration in 2.6.0, although the deprecated handler is still present in current releases and can still be registered directly.

https://github.com/jupyter-server/jupyter_server/pull/1261

### Code-level validation

1. Configure a custom Authorizer that returns false for `execute` on `kernels` for a regular authenticated user.
2. Configure `GatewayClient.url` on Jupyter Server 2.0.0-2.5.0.
3. The normal `KernelWebsocketHandler` would reject that user with 403 in `pre_get`.
4. Gateway mode replaces it with `WebSocketChannelsHandler`. Its `authenticate` method only rejects anonymous users, and `get` proceeds to the upstream gateway without an authorization decision.

### Impact

This is a missing authorization check, not an authentication bypass. It matters in deployments that use a restrictive custom Authorizer and Jupyter Gateway/Enterprise Gateway. A read-only or otherwise limited authenticated user can cross the intended authorization boundary and obtain kernel execution, with access to data and credentials available to that kernel.

### Affected versions

- Default gateway configuration: 2.0.0 through 2.5.0
- 2.6.0 and later: the default path uses the authorized standard handler, but manually registering the deprecated `jupyter_server.gateway.handlers` module still exposes the old behavior.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_