CVE-2026-73627
Description
JupyterLab (pip package 'jupyterlab') versions >=4.1.0,<=4.5.9 and >=4.6.0,<=4.6.1 contain a plugin manager lock-rule enforcement bypass. Two server-side enforcement gaps allow an authenticated user to circumvent administrator lock rules by making direct requests to the /lab/api/plugins endpoint, enabling or disabling plugins that were locked — including child plugins of multi-plugin extensions and plugins locked via the 'lock all' mechanism. This can impact data integrity and bypass hardening or restrictions (e.g., download/upload limits) implemented through locked plugins. Fixed in versions 4.6.2 and 4.5.10.
How to fix
- jupyterlab4.6.2, 4.5.10 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| jupyterlabPyPI | 4.6.0 ≤ v < 4.6.2, 4.1.0 ≤ v < 4.5.10 | 4.6.2, 4.5.10 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.