{
  "schemaVersion": 1,
  "incident": {
    "id": "cve-2026-111058",
    "url": "https://cveboard.org/i/cve-2026-111058",
    "urlPt": "https://cveboard.org/pt/i/cve-2026-111058",
    "json": "https://cveboard.org/i/cve-2026-111058.json",
    "kind": "vuln",
    "live": true,
    "knownExploited": false,
    "severity": "critical",
    "title": "Mercury: Unauthenticated Remote Code Execution via /api/kernels",
    "summary": "Mercury runs a JupyterLab server with anonymous access by default (mercury_app/main.py sets --IdentityProvider.token='' when no --token/MERCURY_TOKEN is given; when tokenless it also sets --ServerApp.disable_check_xsrf=True). It relies on a blocklist (mercury_app/block_handler.py BLOCKED_PATTERNS: /lab, /api/terminals, /api/shutdown, /files) to keep anonymous users off dangerous Jupyter endpoints.",
    "titlePt": "Mercury: execução remota de código não autenticada via /api/kernels",
    "summaryPt": "Mercury executa um servidor JupyterLab com acesso anônimo por padrão (mercury_app/main.py define --IdentityProvider.token='' quando nenhum --token/MERCURY_TOKEN é fornecido; quando sem token, também define --ServerApp.disable_check_xsrf=True). Ele depende de uma lista de bloqueio (mercury_app/block_handler.py BLOCKED_PATTERNS: /lab, /api/terminals, /api/shutdown, /files) para manter usuários anônimos fora de endpoints perigosos do Jupyter.",
    "cves": [
      "CVE-2026-111058"
    ],
    "ghsa": "GHSA-rv4m-xm3f-3ccq",
    "cvss": {
      "score": 9.8,
      "version": "3.1"
    },
    "epss": {
      "percentage": 0.00437,
      "percentile": 0.36703,
      "asOf": "2026-10-23"
    },
    "packages": [
      {
        "ecosystem": "pip",
        "name": "mercury",
        "vulnerable": "<= 3.2.5",
        "fixed": "3.2.6",
        "advisory": "GHSA-rv4m-xm3f-3ccq"
      }
    ],
    "vendor": null,
    "product": null,
    "kev": null,
    "breach": null,
    "retracted": false,
    "sources": [
      {
        "label": "GitHub Advisory Database",
        "url": "https://github.com/advisories/GHSA-rv4m-xm3f-3ccq"
      }
    ],
    "publishedAt": "2026-10-19T16:49:08.000Z",
    "updatedAt": "2026-10-19T16:49:08.000Z"
  },
  "live": true,
  "events": [
    {
      "id": "ghsa:GHSA-rv4m-xm3f-3ccq:ghsa_published:2026-10-19T16:49:08.000Z",
      "incidentId": "cve-2026-111058",
      "type": "ghsa_published",
      "at": "2026-10-19T16:49:08.000Z",
      "detail": {
        "ghsa": "GHSA-rv4m-xm3f-3ccq",
        "severity": "critical",
        "fixed": "3.2.6"
      }
    }
  ]
}