In short
- CVE-2026-40934 is a MEDIUM (CVSS 6.8) vulnerability affecting jupyter-server, jupyter server (jupyter).
- Chance of exploitation in the next 30 days (EPSS): 0.33%, higher than 26.5% of all vulnerabilities.
- Fix: update to 2.18.0 or later.
Description
Summary
A persistent cookie secret vulnerability allows authenticated users to maintain indefinite access even after password changes.
The cookie secret used to sign authentication cookies is stored in a permanent file (~/.local/share/jupyter/runtime/jupyter_cookie_secret) that is never automatically rotated or cleared, allowing stolen or compromised cookies to remain valid indefinitely regardless of password resets.
PoC
- Start a Jupyter server with password authentication:
jupyter server password, jupyter server
- Log in with the password and capture the authentication cookie (e.g., just login with a browser).
- Change the password to revoke access:
jupyter server password
- Restart the server
- Use the old stolen cookie => remains valid and provides full authenticated access.
Impact
- All jupyter-server deployments using password authentication where security incidents may occur
- Multi-user systems where one user's compromised session should be revocable by administrators
- Shared or public-facing Jupyter servers where credential rotation is a security requirement
- Any deployment where password changes are expected to revoke existing sessions
Patches
Jupyter Server 2.18+
Workaround
rm ~/.local/share/jupyter/runtime/jupyter_cookie_secret
# Then restart the server
NVD description
Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the secret used to sign authentication cookies is persisted to a static file at ~/.local/share/jupyter/runtime/jupyter_cookie_secret and is never rotated when a user changes their password. After a password reset and server restart, any previously issued authentication cookie remains cryptographically valid because the signing key has not changed. An attacker who has captured a session cookie through any means retains full authenticated access to the server regardless of subsequent password changes. This affects deployments using password-based authentication, particularly shared or public-facing servers where credential rotation is expected to revoke existing sessions. This issue has been fixed in version 2.18.0.
More vulnerabilities in jupyter-server
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free