CVE-2026-111058

Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. Prior to 3.2.6, default tokenless deployments allow anonymous clients to create Jupyter kernels and send execute_request messages containing arbitrary Python. The endpoint blocklist does not cover /api/kernels, and the websocket wrapper previously tracked idle activity without authorizing executable messages. This issue is fixed in version 3.2.6.

• CWE-862

• https://github.com/mljar/mercury/commit/73a40ceb0becf057f495a5738ad7f5a5222a53e1
• https://github.com/mljar/mercury/releases/tag/3.2.6
• https://github.com/mljar/mercury/security/advisories/GHSA-rv4m-xm3f-3ccq

Published

Oct 19, 2026

Last Modified

Oct 19, 2026

Status

Awaiting Analysis

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-111048FOSSBilling is an open source billing and client-management …8.4
• CVE-2026-11105Insufficient validation of untrusted input in WebUI in Googl…6.5
• CVE-2026-111053FOSSBilling is an open source billing and client-management …6.9
• CVE-2026-111054Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-111056FOSSBilling is an open source billing and client-management …6.9
• CVE-2026-111057Mercury is a Python framework for sharing Jupyter notebooks …10
• CVE-2026-111059Mercury is a Python framework for sharing Jupyter notebooks …6.1
• CVE-2026-11106Inappropriate implementation in Media in Google Chrome prior…6.5
• CVE-2026-111061russh is a Rust SSH client and server library that includes …4.3
• CVE-2026-111063AIOHTTP is an asynchronous HTTP client/server framework for …6.3
• CVE-2026-111064AIOHTTP is an asynchronous HTTP client/server framework for …8.2
• CVE-2026-111065AIOHTTP is an asynchronous HTTP client/server framework for …6.9