Database/AI/ML frameworks & serving
Mercury: blocklist typo exposes Jupyter terminal API to unauthenticated shell access
Impact
A missing comma in BLOCKED_PATTERNS merged two regex literals, so /api/terminals never matched the anonymous blocklist and requests reach Jupyter Server's terminal API. Anyone who can reach a Mercury instance gets an interactive shell as the Mercury process, with no credentials - full read and write to its notebooks, data mounts and any API keys in its environment, and whatever GPU devices the pod holds. Mercury is commonly stood up to publish notebooks to a wider internal audience than the notebook owner, which is exactly the audience that should not get a shell. CVSS 10.0 with a scope change, reflecting that the shell reaches beyond the web app itself.
Who can reach it
Unauthenticated HTTP request to /api/terminals on any Mercury 3.0.0 through 3.2.3 instance the attacker can reach. No login, no user interaction. Internet-exposed dashboards are directly exploitable; internal ones are reachable by any tenant or employee on the same network.
What to do
Upgrade to Mercury 3.2.4 - a Python package upgrade and a restart of the Mercury service, no node maintenance. If you cannot upgrade immediately, block /api/terminals at the ingress or reverse proxy in front of Mercury, or disable terminals in the underlying Jupyter Server config. Assume compromise on any instance that was reachable without authentication: rotate credentials from its environment and inspect its notebook and data mounts.
References
Related entries
- Crawl4AI: /crawl hooks parameter runs attacker Python through exec(), giving unauthenticated RCECVE-2026-26216 · Crawl4AI Docker API (/crawl hooks parameter)Critical
- ChromaDB: Pre-authentication code injectionCVE-2026-45829 · ChromaDBCritical
- Kubeflow Pipelines frontend: unauthenticated SSRF proxy reaches cloud metadata and cluster-internal APIsCVE-2026-54745 · Kubeflow Pipelines frontend (/_proxy/ route in proxy-middleware.ts)Critical
- Xinference: unauthenticated chat request reaches eval() in the Llama3 tool-call parserCVE-2026-61539 · Xinference (Llama3 tool-call parser, `_eval_llama3_chat_arguments`)Critical
- Decepticon: unfiltered ChatML special tokens in crawl results give a target page control of the agentCVE-2026-61732 · Decepticon (LLM message construction from crawl output)Critical
- ClearML web server: XSSCVE-2024-24594 · ClearML web serverCritical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.