Mercury 3.2.6 Patches CVE-2026-111058, Blocking Unauthenticated Python Code Execution on Servers
Attackers could run arbitrary Python code on Mercury servers without credentials. Version 3.2.6 patches the vulnerability that allowed anonymous kernel creation and execution.
Key points
- CVE-2026-111058 allows unauthenticated remote code execution in Mercury versions prior to 3.2.6.
- The flaw stems from a default tokenless configuration and an incomplete endpoint blocklist.
- Version 3.2.6 resolves the issue by enforcing proper authorization for executable messages.
Attackers gained the ability to execute arbitrary Python code on Mercury servers without any form of authentication. This capability allowed them to run commands with the same privileges as the server process. The vulnerability existed in versions of the Python framework prior to 3.2.6. It affected deployments that used the default tokenless configuration, which is common for sharing Jupyter notebooks as web applications.
In plain English
Mercury allows users to share Jupyter notebooks as interactive web dashboards. By default, it runs without requiring a login token if the administrator does not explicitly set one. This default setting meant that anyone with network access could interact with the server. The application attempted to secure itself by blocking access to certain dangerous endpoints. However, it failed to block the specific endpoint required to create and control computation kernels.
The background
The vulnerability, tracked as CVE-2026-111058, has a CVSS score of 9.8, rated as critical. It is associated with CWE-862, which relates to permission issues. The flaw was distinct from a previous issue, GHSA-f8c7, which involved a missing comma in the blocklist for terminal access. Fixing that previous issue did not resolve the kernel access problem. The blocklist approach fundamentally could not secure the kernel endpoint because the application needs it to function.
What changes now
The vendor released version 3.2.6 to address this critical flaw. This update fixes the issue where anonymous clients could create Jupyter kernels and send execute requests. The patch ensures that executable messages are properly authorized. Users running versions prior to 3.2.6 are vulnerable to unauthenticated remote code execution. The fix applies to the pip package named mercury.
What made it possible
Teams usually rely on blocklists to restrict access to sensitive application endpoints. This approach assumes that only specific paths need protection. However, if an application requires access to certain endpoints for core functionality, a blocklist cannot secure them. Attackers exploit this by targeting the necessary endpoints that remain open. Security teams should check whether their applications use blocklists for critical functions. They must verify that authorization is enforced at the message level, not just the path level. This ensures that even if an endpoint is accessible, unauthorized actions are blocked.
What to do and how to stay safe: Mercury
- Check whether your Mercury installation is running a version prior to 3.2.6.
- Verify if your deployment uses the default tokenless configuration.
- Monitor server logs for unauthorized kernel creation attempts.
- Update to version 3.2.6 once the vendor provides the final release.
Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed
General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVE ID for this vulnerability?
The CVE ID is CVE-2026-111058.
Which versions of Mercury are affected?
Versions prior to 3.2.6 are affected.
Is there a patch available?
Yes, version 3.2.6 fixes the issue.
