Vulnerability-Lookup

CVE-2026-73627 (GCVE-0-2026-73627)

Vulnerability from cvelistv5 – Published: 2026-08-13 11:28 – Updated: 2026-09-30 17:20

Title

JupyterLab 4.6.0 Plugin Manager Lock-Rule Enforcement Bypass

Summary

JupyterLab (pip package 'jupyterlab') versions >=4.1.0,<=4.5.9 and >=4.6.0,<=4.6.1 contain a plugin manager lock-rule enforcement bypass. Two server-side enforcement gaps allow an authenticated user to circumvent administrator lock rules by making direct requests to the /lab/api/plugins endpoint, enabling or disabling plugins that were locked — including child plugins of multi-plugin extensions and plugins locked via the 'lock all' mechanism. This can impact data integrity and bypass hardening or restrictions (e.g., download/upload limits) implemented through locked plugins. Fixed in versions 4.6.2 and 4.5.10.

Severity

6 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-15 03:13 UTC

CWE

CWE-602 - Client-Side Enforcement of Server-Side Security

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6762 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/jupyterlab/jupyterlab/security…	vendor-advisory
https://www.vulncheck.com/advisories/jupyterlab-p…	third-party-advisory

Impacted products

2 products

Vendor	Product	Version	CPE status
jupyterlab	jupyterlab	Affected: 4.6.0 , ≤ 4.6.1 (semver)	guessed
jupyterlab	jupyterlab	Affected: 4.1.0 , ≤ 4.5.9 (semver)	guessed

Date Public

2026-07-21 00:00

Credits

rexpository MUFFANUJ krassowski

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73627",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-15T03:13:31.123307Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-15T03:13:40.300Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/jupyterlab",
          "product": "jupyterlab",
          "vendor": "jupyterlab",
          "versions": [
            {
              "lessThanOrEqual": "4.6.1",
              "status": "affected",
              "version": "4.6.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/jupyterlab",
          "product": "jupyterlab",
          "vendor": "jupyterlab",
          "versions": [
            {
              "lessThanOrEqual": "4.5.9",
              "status": "affected",
              "version": "4.1.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:jupyter:jupyterlab:4.1.0:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:jupyter:jupyterlab:4.5.0:rc0:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:jupyter:jupyterlab:4.5.0:rc1:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:jupyter:jupyterlab:4.5.0:-:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:jupyter:jupyterlab:4.5.1:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:jupyter:jupyterlab:4.5.2:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:jupyter:jupyterlab:4.5.3:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:jupyter:jupyterlab:4.5.4:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:jupyter:jupyterlab:4.5.5:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:jupyter:jupyterlab:4.5.6:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:jupyter:jupyterlab:4.5.7:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:jupyter:jupyterlab:4.6.0:alpha0:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:jupyter:jupyterlab:4.6.0:alpha1:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:jupyter:jupyterlab:4.6.0:alpha2:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:jupyter:jupyterlab:4.6.0:alpha3:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:jupyter:jupyterlab:4.6.0:alpha4:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:jupyter:jupyterlab:4.6.0:alpha5:*:*:*:*:*:*",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "rexpository"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "MUFFANUJ"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "krassowski"
        }
      ],
      "datePublic": "2026-07-21T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "JupyterLab (pip package \u0027jupyterlab\u0027) versions \u003e=4.1.0,\u003c=4.5.9 and \u003e=4.6.0,\u003c=4.6.1 contain a plugin manager lock-rule enforcement bypass. Two server-side enforcement gaps allow an authenticated user to circumvent administrator lock rules by making direct requests to the /lab/api/plugins endpoint, enabling or disabling plugins that were locked \u2014 including child plugins of multi-plugin extensions and plugins locked via the \u0027lock all\u0027 mechanism. This can impact data integrity and bypass hardening or restrictions (e.g., download/upload limits) implemented through locked plugins. Fixed in versions 4.6.2 and 4.5.10."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-602",
              "description": "Client-Side Enforcement of Server-Side Security",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T17:20:27.405Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-h5v5-8746-g7mm)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-h5v5-8746-g7mm"
        },
        {
          "name": "VulnCheck Advisory: JupyterLab 4.6.0 Plugin Manager Lock-Rule Enforcement Bypass",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/jupyterlab-plugin-manager-lock-rule-enforcement-bypass"
        }
      ],
      "title": "JupyterLab 4.6.0 Plugin Manager Lock-Rule Enforcement Bypass",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-73627",
    "datePublished": "2026-08-13T11:28:26.249Z",
    "dateReserved": "2026-08-13T11:17:25.160Z",
    "dateUpdated": "2026-09-30T17:20:27.405Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-73627",
      "date": "2026-10-22",
      "epss": "0.00422",
      "percentile": "0.35403"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "packageURL": "pkg:pypi/jupyterlab",
                "product": "jupyterlab",
                "vendor": "jupyterlab",
                "versions": [
                  {
                    "lessThanOrEqual": "4.6.1",
                    "status": "affected",
                    "version": "4.6.0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "packageURL": "pkg:pypi/jupyterlab",
                "product": "jupyterlab",
                "vendor": "jupyterlab",
                "versions": [
                  {
                    "lessThanOrEqual": "4.5.9",
                    "status": "affected",
                    "version": "4.1.0",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "disclosure@vulncheck.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "JupyterLab (pip package \u0027jupyterlab\u0027) versions \u003e=4.1.0,\u003c=4.5.9 and \u003e=4.6.0,\u003c=4.6.1 contain a plugin manager lock-rule enforcement bypass. Two server-side enforcement gaps allow an authenticated user to circumvent administrator lock rules by making direct requests to the /lab/api/plugins endpoint, enabling or disabling plugins that were locked \u2014 including child plugins of multi-plugin extensions and plugins locked via the \u0027lock all\u0027 mechanism. This can impact data integrity and bypass hardening or restrictions (e.g., download/upload limits) implemented through locked plugins. Fixed in versions 4.6.2 and 4.5.10."
          }
        ],
        "id": "CVE-2026-73627",
        "lastModified": "2026-09-30T18:18:39.947",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 6.0,
                "baseSeverity": "MEDIUM",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "LOW",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "LOW",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "disclosure@vulncheck.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-73627",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-15T03:13:31.123307Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-08-13T12:17:28.043",
        "references": [
          {
            "source": "disclosure@vulncheck.com",
            "url": "https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-h5v5-8746-g7mm"
          },
          {
            "source": "disclosure@vulncheck.com",
            "url": "https://www.vulncheck.com/advisories/jupyterlab-plugin-manager-lock-rule-enforcement-bypass"
          }
        ],
        "sourceIdentifier": "disclosure@vulncheck.com",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-602"
              }
            ],
            "source": "disclosure@vulncheck.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-10-22T05:53:59+00:00",
      "cve": "CVE-2026-73627",
      "id": "CVE-2026-73627",
      "initial_release_date": "2026-08-13T11:28:26.249000+00:00",
      "product_status:fixed": "73",
      "product_status:known_affected": "4",
      "product_status:known_not_affected": "900",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "jupyterlab: JupyterLab: Plugin manager lock-rule bypass allows unauthorized plugin control",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-73627.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-10-01T00:43:28Z",
      "cve": "CVE-2026-73627",
      "id": "CVE-2026-73627",
      "initial_release_date": "2026-08-13T16:21:35Z",
      "product_status:recommended": "3",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-73627",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-73627.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-73627",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-15T03:13:31.123307Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-15T03:13:35.927Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "affected",
              "packageURL": "pkg:pypi/jupyterlab",
              "product": "jupyterlab",
              "vendor": "jupyterlab",
              "versions": [
                {
                  "lessThan": "4.6.0",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "packageURL": "pkg:pypi/jupyterlab",
              "product": "jupyterlab",
              "vendor": "jupyterlab",
              "versions": [
                {
                  "lessThan": "4.1.0",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:a:jupyter:jupyterlab:4.1.0:*:*:*:*:*:*:*",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:jupyter:jupyterlab:4.5.0:rc0:*:*:*:*:*:*",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:jupyter:jupyterlab:4.5.0:rc1:*:*:*:*:*:*",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:jupyter:jupyterlab:4.5.0:-:*:*:*:*:*:*",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:jupyter:jupyterlab:4.5.1:*:*:*:*:*:*:*",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:jupyter:jupyterlab:4.5.2:*:*:*:*:*:*:*",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:jupyter:jupyterlab:4.5.3:*:*:*:*:*:*:*",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:jupyter:jupyterlab:4.5.4:*:*:*:*:*:*:*",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:jupyter:jupyterlab:4.5.5:*:*:*:*:*:*:*",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:jupyter:jupyterlab:4.5.6:*:*:*:*:*:*:*",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:jupyter:jupyterlab:4.5.7:*:*:*:*:*:*:*",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:jupyter:jupyterlab:4.6.0:alpha0:*:*:*:*:*:*",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:jupyter:jupyterlab:4.6.0:alpha1:*:*:*:*:*:*",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:jupyter:jupyterlab:4.6.0:alpha2:*:*:*:*:*:*",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:jupyter:jupyterlab:4.6.0:alpha3:*:*:*:*:*:*",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:jupyter:jupyterlab:4.6.0:alpha4:*:*:*:*:*:*",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:jupyter:jupyterlab:4.6.0:alpha5:*:*:*:*:*:*",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "reporter",
              "value": "rexpository"
            },
            {
              "lang": "en",
              "type": "finder",
              "value": "MUFFANUJ"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "krassowski"
            }
          ],
          "datePublic": "2026-07-21T00:00:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "value": "JupyterLab (pip package \u0027jupyterlab\u0027) versions \u003e=4.1.0,\u003c=4.5.9 and \u003e=4.6.0,\u003c=4.6.1 contain a plugin manager lock-rule enforcement bypass. Two server-side enforcement gaps allow an authenticated user to circumvent administrator lock rules by making direct requests to the /lab/api/plugins endpoint, enabling or disabling plugins that were locked \u2014 including child plugins of multi-plugin extensions and plugins locked via the \u0027lock all\u0027 mechanism. This can impact data integrity and bypass hardening or restrictions (e.g., download/upload limits) implemented through locked plugins. Fixed in versions 4.6.2 and 4.5.10."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "NETWORK",
                "baseScore": 6,
                "baseSeverity": "MEDIUM",
                "privilegesRequired": "LOW",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "LOW",
                "vulnIntegrityImpact": "HIGH"
              },
              "format": "CVSS"
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-602",
                  "description": "Client-Side Enforcement of Server-Side Security",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-13T11:28:26.249Z",
            "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
            "shortName": "VulnCheck"
          },
          "references": [
            {
              "name": "GitHub Security Advisory (GHSA-h5v5-8746-g7mm)",
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-h5v5-8746-g7mm"
            },
            {
              "name": "VulnCheck Advisory: JupyterLab 4.6.0 Plugin Manager Lock-Rule Enforcement Bypass",
              "tags": [
                "third-party-advisory"
              ],
              "url": "https://www.vulncheck.com/advisories/jupyterlab-plugin-manager-lock-rule-enforcement-bypass"
            }
          ],
          "title": "JupyterLab 4.6.0 Plugin Manager Lock-Rule Enforcement Bypass",
          "x_generator": {
            "engine": "vulncheck-endgame"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "assignerShortName": "VulnCheck",
        "cveId": "CVE-2026-73627",
        "datePublished": "2026-08-13T11:28:26.249Z",
        "dateReserved": "2026-08-13T11:17:25.160Z",
        "dateUpdated": "2026-08-15T03:13:40.300Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

bit-jupyterlab-2026-73627

Vulnerability from bitnami_vulndb

Published

2026-09-25 12:23

Modified

2026-09-25 12:52

Summary

JupyterLab 4.6.0 Plugin Manager Lock-Rule Enforcement Bypass

Details

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Bitnami",
        "name": "jupyterlab",
        "purl": "pkg:bitnami/jupyterlab"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.1.0"
            },
            {
              "fixed": "4.5.10"
            },
            {
              "introduced": "4.6.0"
            },
            {
              "fixed": "4.6.2"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "severity": [
        {
          "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "type": "CVSS_V4"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-73627"
  ],
  "database_specific": {
    "cpes": [
      "cpe:2.3:a:jupyter:jupyterlab:*:*:*:*:*:python:*:*"
    ],
    "severity": "Medium"
  },
  "details": "JupyterLab (pip package \u0027jupyterlab\u0027) versions \u003e=4.1.0,\u003c=4.5.9 and \u003e=4.6.0,\u003c=4.6.1 contain a plugin manager lock-rule enforcement bypass. Two server-side enforcement gaps allow an authenticated user to circumvent administrator lock rules by making direct requests to the /lab/api/plugins endpoint, enabling or disabling plugins that were locked \u2014 including child plugins of multi-plugin extensions and plugins locked via the \u0027lock all\u0027 mechanism. This can impact data integrity and bypass hardening or restrictions (e.g., download/upload limits) implemented through locked plugins. Fixed in versions 4.6.2 and 4.5.10.",
  "id": "BIT-jupyterlab-2026-73627",
  "modified": "2026-09-25T12:52:12.177Z",
  "published": "2026-09-25T12:23:15.905Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-h5v5-8746-g7mm"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73627"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/jupyterlab-plugin-manager-lock-rule-enforcement-bypass"
    }
  ],
  "schema_version": "1.6.2",
  "summary": "JupyterLab 4.6.0 Plugin Manager Lock-Rule Enforcement Bypass"
}

BREW-JUPYTERLAB-GHSA-H5V… (GHSA-H5V5-8746-G7MM)

Vulnerability from osv_homebrew – Published: 2026-08-13 17:01 – Updated: 2026-10-05 04:49 – Source website

Summary

JupyterLab PluginManager lock-rule enforcement bypass

Details

JupyterLab's plugin manager exposes administrator controls intended to prevent users from enabling or disabling selected plugins. Two server-side enforcement gaps let an authenticated user bypass those controls with direct requests to /lab/api/plugins.

Impact

Users could workaround the plugin manager lock rules via direct API access for either: - child plugins of extensions covering multiple plugins - when "lock all" was issued by the administrator

The integrity of data can be impacted, and any hardening or restrictions on permitted user actions (e.g. download/upload limits) within the single-user server can be circumvented if those were implemented with plugins that were locked using the faulty mechanisms.

Patches

JupyterLab v4.6.2 and v4.5.10 contain the patch.

Users of applications that depend on JupyterLab, such as Notebook v7+, should update jupyterlab package too.

Workarounds

Manually lock all plugins that should be locked. The core plugin identifiers can be found in the documentation and identifiers for all installed extensions are listed in the Plugin Manager.

Severity

6.0 (Medium)


                    
                      CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

References

URL

Type

	https://github.com/jupyterlab/jupyterlab/security…	WEB
	https://github.com/jupyterlab/jupyterlab/pull/19184	WEB
	https://github.com/jupyterlab/jupyterlab/pull/19185	WEB
	https://github.com/jupyterlab/jupyterlab/pull/19186	WEB
	https://github.com/jupyterlab/jupyterlab/commit/b…	WEB
	https://github.com/jupyterlab/jupyterlab/commit/f…	WEB
	https://github.com/jupyterlab/jupyterlab	PACKAGE
	https://github.com/jupyterlab/jupyterlab/releases…	WEB
	https://github.com/jupyterlab/jupyterlab/releases…	WEB

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": "bump",
        "range_state": "fixed",
        "upstream_fixed_in": "4.6.2"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "jupyterlab",
        "purl": "pkg:brew/jupyterlab"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.1.0"
            },
            {
              "fixed": "4.6.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "registry",
    "upstream_evidence": [
      {
        "ecosystem": "PyPI",
        "key": "pkg:pypi/jupyterlab@4.6.4",
        "name": "jupyterlab",
        "strategy": "registry",
        "subject_version": "4.6.4"
      },
      {
        "ecosystem": "Debian",
        "key": "Debian/jupyterlab",
        "name": "jupyterlab",
        "strategy": "distro"
      },
      {
        "ecosystem": "PyPI",
        "key": "upstream:pkg:pypi/jupyterlab@4.6.4",
        "name": "jupyterlab",
        "strategy": "distro",
        "subject_version": "4.6.4"
      },
      {
        "ecosystem": "Ubuntu",
        "key": "Ubuntu/jupyterlab",
        "name": "jupyterlab",
        "strategy": "distro"
      }
    ]
  },
  "details": "JupyterLab\u0027s plugin manager exposes administrator controls intended to prevent users from enabling or disabling selected plugins. Two server-side enforcement gaps let an authenticated user bypass those controls with direct requests to `/lab/api/plugins`.\n\n### Impact\n\nUsers could workaround the plugin manager lock rules via direct API access for either:\n- child plugins of extensions covering multiple plugins\n- when \"lock all\" was issued by the administrator\n\nThe integrity of data can be impacted, and any hardening or restrictions on permitted user actions (e.g. download/upload limits) within the single-user server can be circumvented if those were implemented with plugins that were locked using the faulty mechanisms.\n\n### Patches\n\nJupyterLab [`v4.6.2`](https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.2) and [`v4.5.10`](https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.10) contain the patch.\n\nUsers of applications that depend on JupyterLab, such as Notebook v7+, should update `jupyterlab` package too.\n\n### Workarounds\n\nManually lock all plugins that should be locked. The core plugin identifiers can be found in [the documentation](https://jupyterlab.readthedocs.io/en/latest/extension/extension_points.html#core-plugins) and identifiers for all installed extensions are listed in the [Plugin Manager](https://jupyterlab.readthedocs.io/en/latest/user/extensions.html#managing-plugins-with-plugin-manager).",
  "id": "BREW-jupyterlab-GHSA-h5v5-8746-g7mm",
  "modified": "2026-10-05T04:49:24Z",
  "published": "2026-08-13T17:01:18Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-h5v5-8746-g7mm"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jupyterlab/jupyterlab/pull/19184"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jupyterlab/jupyterlab/pull/19185"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jupyterlab/jupyterlab/pull/19186"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jupyterlab/jupyterlab/commit/be9303f5bcd5308eaeae953c5a3c903046682c2c"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jupyterlab/jupyterlab/commit/f1beab4a2027af4719d6edc07d52d6cf5a39a432"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jupyterlab/jupyterlab"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.10"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.2"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "JupyterLab PluginManager lock-rule enforcement bypass",
  "upstream": [
    "GHSA-h5v5-8746-g7mm",
    "BIT-jupyterlab-2026-73627",
    "CVE-2026-73627"
  ]
}

FKIE_CVE-2026-73627

Vulnerability from fkie_nvd - Published: 2026-08-13 12:17 - Updated: 2026-09-30 18:18

Severity

6.0 (Medium) - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Summary

References

	URL	Tags
	disclosure@vulncheck.com	https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-h5v5-8746-g7mm
	disclosure@vulncheck.com	https://www.vulncheck.com/advisories/jupyterlab-plugin-manager-lock-rule-enforcement-bypass

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/jupyterlab",
          "product": "jupyterlab",
          "vendor": "jupyterlab",
          "versions": [
            {
              "lessThanOrEqual": "4.6.1",
              "status": "affected",
              "version": "4.6.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/jupyterlab",
          "product": "jupyterlab",
          "vendor": "jupyterlab",
          "versions": [
            {
              "lessThanOrEqual": "4.5.9",
              "status": "affected",
              "version": "4.1.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "disclosure@vulncheck.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "JupyterLab (pip package \u0027jupyterlab\u0027) versions \u003e=4.1.0,\u003c=4.5.9 and \u003e=4.6.0,\u003c=4.6.1 contain a plugin manager lock-rule enforcement bypass. Two server-side enforcement gaps allow an authenticated user to circumvent administrator lock rules by making direct requests to the /lab/api/plugins endpoint, enabling or disabling plugins that were locked \u2014 including child plugins of multi-plugin extensions and plugins locked via the \u0027lock all\u0027 mechanism. This can impact data integrity and bypass hardening or restrictions (e.g., download/upload limits) implemented through locked plugins. Fixed in versions 4.6.2 and 4.5.10."
    }
  ],
  "id": "CVE-2026-73627",
  "lastModified": "2026-09-30T18:18:39.947",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 6.0,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "LOW",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "disclosure@vulncheck.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-73627",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-15T03:13:31.123307Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-13T12:17:28.043",
  "references": [
    {
      "source": "disclosure@vulncheck.com",
      "url": "https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-h5v5-8746-g7mm"
    },
    {
      "source": "disclosure@vulncheck.com",
      "url": "https://www.vulncheck.com/advisories/jupyterlab-plugin-manager-lock-rule-enforcement-bypass"
    }
  ],
  "sourceIdentifier": "disclosure@vulncheck.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-602"
        }
      ],
      "source": "disclosure@vulncheck.com",
      "type": "Secondary"
    }
  ]
}

GHSA-FPF6-H6P9-9RJR

Vulnerability from github – Published: 2026-08-13 12:31 – Updated: 2026-08-13 12:31

Details

Severity

6.0 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-73627"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-602"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-13T12:17:28Z",
    "severity": "MODERATE"
  },
  "details": "JupyterLab (pip package \u0027jupyterlab\u0027) versions \u003e=4.1.0,\u003c=4.5.9 and \u003e=4.6.0,\u003c=4.6.1 contain a plugin manager lock-rule enforcement bypass. Two server-side enforcement gaps allow an authenticated user to circumvent administrator lock rules by making direct requests to the /lab/api/plugins endpoint, enabling or disabling plugins that were locked \u2014 including child plugins of multi-plugin extensions and plugins locked via the \u0027lock all\u0027 mechanism. This can impact data integrity and bypass hardening or restrictions (e.g., download/upload limits) implemented through locked plugins. Fixed in versions 4.6.2 and 4.5.10.",
  "id": "GHSA-fpf6-h6p9-9rjr",
  "modified": "2026-08-13T12:31:11Z",
  "published": "2026-08-13T12:31:11Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-h5v5-8746-g7mm"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73627"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/jupyterlab-plugin-manager-lock-rule-enforcement-bypass"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

OPENSUSE-SU-2026:11634-1

Vulnerability from csaf_opensuse - Published: 2026-08-28 00:00 - Updated: 2026-09-17 17:21

Summary

jupyter-jupyterlab-4.5.10-1.1 on GA media

Severity

Moderate

Scope

5 vulnerabilities in this advisory, including CVE-2026-73627.

CVE-2026-73627

Recommended: 12 products

Open the full advisory

RHSA-2026:65126

Vulnerability from csaf_redhat - Published: 2026-09-08 07:57 - Updated: 2026-10-23 11:00

Summary

Red Hat Security Advisory: RHOAI 2.25.11 - Red Hat OpenShift AI

Severity

Important

Scope

117 vulnerabilities in this advisory, including CVE-2026-73627.

CVE-2026-73627

A flaw was found in JupyterLab. An authenticated user can bypass administrator lock rules in the plugin manager by making direct requests to the `/lab/api/plugins` endpoint. This allows them to enable or disable plugins that were locked, including child plugins and those locked via the 'lock all' mechanism. This vulnerability can impact data integrity and circumvent hardening or restrictions implemented through locked plugins.

7.1 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Fixed: 20 products Known not affected: 189 products

https://access.redhat.com/errata/RHSA-2026:65126

Open the full advisory

RHSA-2026:73987

Vulnerability from csaf_redhat - Published: 2026-09-30 13:36 - Updated: 2026-10-23 11:19

Summary

Red Hat Security Advisory: RHOAI 3.3.7 - Red Hat OpenShift AI

Severity

Critical

Scope

125 vulnerabilities in this advisory, including CVE-2026-73627.

CVE-2026-73627

7.1 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Fixed: 21 products Known not affected: 214 products

https://access.redhat.com/errata/RHSA-2026:73987

Open the full advisory

RHSA-2026:84734

Vulnerability from csaf_redhat - Published: 2026-10-19 08:52 - Updated: 2026-10-23 11:19

Summary

Red Hat Security Advisory: RHOAI 3.4.5 - Red Hat OpenShift AI

Severity

Critical

Scope

298 vulnerabilities in this advisory, including CVE-2026-73627.

CVE-2026-73627

7.1 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Fixed: 29 products Known not affected: 292 products

https://access.redhat.com/errata/RHSA-2026:84734

Open the full advisory

RHSA-2026:87410

Vulnerability from csaf_redhat - Published: 2026-10-21 21:07 - Updated: 2026-10-23 11:19

Summary

Red Hat Security Advisory: RHOAI 2.25.12 - Red Hat OpenShift AI

Severity

Critical

Scope

177 vulnerabilities in this advisory, including CVE-2026-73627.

CVE-2026-73627

7.1 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Fixed: 3 products Known not affected: 202 products

https://access.redhat.com/errata/RHSA-2026:87410

Open the full advisory

UBUNTU-CVE-2026-73627 (CVE-2026-73627)

Vulnerability from osv_ubuntu – Published: 2026-08-13 12:17 – Updated: 2026-10-17 09:51 – Source website

Details

Severity

6.0 (Medium)


                    
                      CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-73627	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-73627	REPORT
	https://github.com/jupyterlab/jupyterlab/security…	REPORT
	https://www.vulncheck.com/advisories/jupyterlab-p…	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "jupyterlab",
            "binary_version": "4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.10",
        "name": "jupyterlab",
        "purl": "pkg:deb/ubuntu/jupyterlab@4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-4?arch=source\u0026distro=stonking"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.0.11+ds1+~cs11.25.27-9",
        "4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-3",
        "4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-4"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "jupyterlab",
            "binary_version": "4.0.11+ds1+~cs11.25.27-9"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "jupyterlab",
        "purl": "pkg:deb/ubuntu/jupyterlab@4.0.11+ds1+~cs11.25.27-9?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.0.11+ds1+~cs11.25.27-7",
        "4.0.11+ds1+~cs11.25.27-8",
        "4.0.11+ds1+~cs11.25.27-9"
      ]
    }
  ],
  "aliases": [],
  "details": "JupyterLab (pip package \u0027jupyterlab\u0027) versions \u003e=4.1.0,\u003c=4.5.9 and \u003e=4.6.0,\u003c=4.6.1 contain a plugin manager lock-rule enforcement bypass. Two server-side enforcement gaps allow an authenticated user to circumvent administrator lock rules by making direct requests to the /lab/api/plugins endpoint, enabling or disabling plugins that were locked \u2014 including child plugins of multi-plugin extensions and plugins locked via the \u0027lock all\u0027 mechanism. This can impact data integrity and bypass hardening or restrictions (e.g., download/upload limits) implemented through locked plugins. Fixed in versions 4.6.2 and 4.5.10.",
  "id": "UBUNTU-CVE-2026-73627",
  "modified": "2026-10-17T09:51:13Z",
  "published": "2026-08-13T12:17:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-73627"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-73627"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-h5v5-8746-g7mm"
    },
    {
      "type": "REPORT",
      "url": "https://www.vulncheck.com/advisories/jupyterlab-plugin-manager-lock-rule-enforcement-bypass"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-73627"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-73627 (GCVE-0-2026-73627)

Vulnerability from bitnami_vulndb

BREW-JUPYTERLAB-GHSA-H5V… (GHSA-H5V5-8746-G7MM)

Impact

Patches

Workarounds

UBUNTU-CVE-2026-73627 (CVE-2026-73627)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour