점검 대응높음KEV 미등록
CVE-2026-40110
jupyter-server jupyter_server, Red Hat Migration Toolkit for Applications 8.2, Red Hat OpenShift AI (RHOAI) 취약점
Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the Origin header validation uses Python's re.match() to check incoming origins against the allow_origin_pat configuration value. Because re.match() only anchors at the start of the string and does not require a full match, a pattern intended to match only a trusted domain (e.g., trusted.example.com) will also match any origin that begins with that domain followed by additional characters (e.g., trusted.example.com.evil.com). An attacker who controls such a domain can bypass the CORS origin restricti...
- 대응 우선순위
- 점검
- CVSS
- 7.6
- EPSS
- 0.34% 백분위 26.7% · 2026.08.02 기준
- CISA KEV
- 미등록
- 조치 기한
- -
- 공개일
- 2026.05.06