PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-40934 Jupyter CVE debrief

CVE-2026-40934 is a session-revocation weakness in Jupyter Server versions 2.17.0 and earlier. Because the secret used to sign authentication cookies is stored in a static runtime file and is not rotated when a user changes their password, previously issued cookies can remain valid after a password reset and server restart. The issue is fixed in Jupyter Server 2.18.0.

Vendor
Jupyter
Product
Jupyter Server
CVSS
HIGH 7.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-05
Original CVE updated
2026-07-25
Advisory published
2026-05-05
Advisory updated
2026-07-25

Who should care

Administrators and operators of Jupyter Server deployments that use password-based authentication, especially shared, multi-user, or publicly reachable servers where password resets are expected to invalidate existing sessions.

Technical summary

According to the NVD record and the linked GitHub security advisory, Jupyter Server persisted the cookie-signing secret at ~/.local/share/jupyter/runtime/jupyter_cookie_secret and did not rotate it when a password changed. As a result, authentication cookies signed before the reset could continue to validate after restart. The vulnerability is mapped to CWE-613 (Insufficient Session Expiration) and affects Jupyter Server versions up to, but not including, 2.18.0.

Defensive priority

High. This is a high-severity authentication/session persistence issue (CVSS 7.6) that can preserve authenticated access after credential changes. Prioritize upgrades and session-invalidating operational checks.

Recommended defensive actions

  • Upgrade Jupyter Server to version 2.18.0 or later.
  • Treat password changes as insufficient for session revocation until the fixed version is deployed.
  • Review whether any long-lived or shared authentication cookies may still be accepted after password resets.
  • For exposed or multi-user deployments, validate that operational password rotation procedures include application upgrade and session reauthentication.
  • Monitor the linked vendor advisory for any additional mitigation guidance.

Evidence notes

Source evidence comes from the official NVD record for CVE-2026-40934 and the linked GitHub security advisory. The NVD record lists Jupyter Server as affected through versions earlier than 2.18.0, includes the CWE-613 mapping, and references the vendor advisory for mitigation. The CVE published timestamp used here is 2026-05-05T22:16:00.820Z, with a later record modification on 2026-05-11T13:00:39.473Z.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-40934 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-40934

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-40934 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-40934

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.