CVE-2026-73627 JupyterLab 4.6.0 Plugin Manager Lock-Rule Enforcement Bypass
Authenticated users can bypass administrator plugin lock rules in JupyterLab, enabling or disabling restricted plugins and circumventing security hardening measures.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-73627?
CVE-2026-73627 is a medium-severity vulnerability in jupyterlab, published on 13 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
JupyterLab (pip package 'jupyterlab') versions >=4.1.0,<=4.5.9 and >=4.6.0,<=4.6.1 contain a plugin manager lock-rule enforcement bypass. Two server-side enforcement gaps allow an authenticated user to circumvent administrator lock rules by making direct requests to the /lab/api/plugins endpoint, enabling or disabling plugins that were locked — including child plugins of multi-plugin extensions and plugins locked via the 'lock all' mechanism. This can impact data integrity and bypass hardening or restrictions (e.g., download/upload limits) implemented through locked plugins. Fixed in versions 4.6.2 and 4.5.10.
Weakness: CWE-602
Which versions are affected by CVE-2026-73627?
5 open source packages ship an affected version, including jupyterlab.
| Package | Affected | Fixed in |
|---|---|---|
jupyterlab Bitnami | From 4.1.0 | 4.5.10, 4.6.2 |
jupyterlab PyPI | From 4.1.0 | 4.5.10 |
jupyterlab PyPI | From 4.1.0 | 4.5.10 |
jupyterlab PyPI | From 4.6.0 | 4.6.2 |
jupyterlab PyPI | From 4.6.0 | 4.6.2 |
How do I fix CVE-2026-73627?
Upgrade jupyterlab to a fixed version for your release line: 4.5.10 or 4.6.2.
Is CVE-2026-73627 being exploited?
There is no known exploitation of CVE-2026-73627 in the wild and no public exploit code.
Sources
Also known as BIT-jupyterlab-2026-73627, CLEANSTART-2026-ED51951, DEBIAN-CVE-2026-73627, GHSA-fpf6-h6p9-9rjr, GHSA-h5v5-8746-g7mm, MINI-hxg6-j69m-wvr6 and 1 more.