CVE-2026-111058
9.8CriticalPublished 19 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-862
Impact
Unauthenticated remote attackers can execute arbitrary Python code on the server by creating Jupyter kernels and sending execute requests. They only need network access to default tokenless Mercury deployments.
Root cause
The /api/kernels endpoint is omitted from the access blocklist, and the WebSocket handler executes incoming messages without checking client authorization.
Affected systems
mljar-mercury prior to 3.2.6
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade mljar-mercury to 3.2.6. If you cannot immediately upgrade, restrict network access to the server or place it behind an authenticating reverse proxy.
$ pip install --upgrade mljar-mercury==3.2.6AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. Prior to 3.2.6, default tokenless deployments allow anonymous clients to create Jupyter kernels and send execute_request messages containing arbitrary Python. The endpoint blocklist does not cover /api/kernels, and the websocket wrapper previously tracked idle activity without authorizing executable messages. This issue is fixed in version 3.2.6.