CVE-2026-73627: 
JupyterLab vulnerability analysis and mitigation

CVE-2026-73627 is a plugin manager lock-rule enforcement bypass vulnerability in JupyterLab (pip package jupyterlab). It affects versions >=4.1.0,<=4.5.9 and >=4.6.0,<=4.6.1, and allows authenticated users to circumvent administrator-configured plugin lock rules by making direct requests to the /lab/api/plugins API endpoint. The vulnerability was published on August 13, 2026, with fixes available in versions 4.6.2 and 4.5.10. It carries a CVSS v4.0 base score of 6.0 (Medium), assigned by VulnCheck (GitHub Advisory, VulnCheck).

The root cause is classified as CWE-602 (Client-Side Enforcement of Server-Side Security) and CWE-863 (Incorrect Authorization): the server fails to properly enforce plugin lock rules when the /lab/api/plugins endpoint is accessed directly, bypassing the controls exposed through the Plugin Manager UI (GitHub Advisory). Two distinct server-side enforcement gaps exist: one affecting child plugins of multi-plugin extensions, and another affecting plugins locked via the administrator's 'lock all' mechanism. An authenticated user with low privileges can exploit this by crafting direct HTTP requests to /lab/api/plugins to enable or disable plugins that should be administratively locked, without requiring any user interaction beyond authentication (VulnCheck).

Successful exploitation allows an authenticated JupyterLab user to enable or disable plugins that administrators have locked, undermining the integrity of administrator-enforced security configurations. This can bypass hardening measures implemented through locked plugins — such as download/upload limits or data access restrictions — within the single-user server context. While availability is not directly impacted and confidentiality impact is limited (low), the high integrity impact reflects the ability to subvert administrative controls and potentially expose sensitive data or enable unauthorized actions (GitHub Advisory, VulnCheck).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure (Feedly). The vulnerability requires the attacker to be an authenticated user with low privileges, and attack requirements are noted as 'Present' (AT:P), meaning certain deployment conditions must exist. The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory).

1. Authentication: Obtain valid credentials for a JupyterLab instance running an affected version (>=4.1.0,<=4.5.9 or >=4.6.0,<=4.6.1) with administrator-configured plugin lock rules in place.
2. Identify locked plugins: Browse the Plugin Manager UI or enumerate plugins via the /lab/api/plugins endpoint to identify which plugins are locked by the administrator, including child plugins of multi-plugin extensions.
3. Craft direct API request: Using a tool such as curl or a browser's developer tools, send a direct HTTP request (e.g., PATCH or POST) to /lab/api/plugins with a payload specifying the target plugin identifier and the desired state (enabled/disabled), bypassing the UI-level lock enforcement.
4. Bypass lock rule: The server fails to validate the lock status server-side for the targeted plugin type (child plugin or 'lock all' scenario), accepting the state change and enabling or disabling the locked plugin.
5. Achieve objective: With the previously locked plugin now enabled or disabled, the attacker can circumvent restrictions such as download/upload limits or other hardening controls implemented through that plugin (GitHub Advisory, VulnCheck).

• Network: Unexpected or repeated HTTP requests (e.g., PATCH, POST) to the /lab/api/plugins endpoint from authenticated non-administrator user sessions; requests to this endpoint outside of normal Plugin Manager UI interactions.
• Logs: JupyterLab server access logs showing direct API calls to /lab/api/plugins with plugin state-change payloads from regular user accounts; log entries reflecting plugin enable/disable events not initiated by an administrator.
• Application State: Plugin configurations deviating from administrator-set lock rules; previously locked plugins appearing as enabled or disabled contrary to policy in the Plugin Manager.

Upgrade JupyterLab to version 4.6.2 or 4.5.10, which contain the fix for both enforcement gaps (GitHub Advisory). Users of applications that depend on JupyterLab (such as Notebook v7+) should also update the jupyterlab package. As a workaround where immediate upgrading is not possible, administrators should manually lock all plugins that require protection using the Plugin Manager (ensuring individual plugin identifiers are explicitly locked rather than relying solely on the 'lock all' mechanism), and restrict network access to the /lab/api/plugins endpoint at the firewall or reverse proxy level (VulnCheck).

The vulnerability was reported by researcher rexpository, with remediation developed by krassowski and coordination by MUFFANUJ (GitHub Advisory). The advisory notes that CVE assignment was initially pending due to a severe backlog at the GitHub CNA. No significant broader media coverage or notable social media reactions have been identified at this time.