CVE-2026-111057

{
  "etk_id": "ETK-2026-2065",
  "cve_id": "CVE-2026-111057",
  "display_id": "CVE-2026-111057",
  "ghsa_id": "GHSA-f8c7-rwf9-fmgm",
  "euvd_id": "EUVD-2026-104419",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Authentication bypass in mljar mercury terminal API",
  "summary": "mljar mercury versions 3.0.0 through 3.2.3 can expose the Jupyter terminal interface without authentication because an intended route restriction is ineffective. An unauthenticated remote attacker who can reach the affected service may execute operating-system commands and access data available to the Mercury process.",
  "mitigation": "Upgrade mercury to version 3.2.4 or later. Until upgraded, restrict network access to Mercury and prevent unauthenticated users from reaching its terminal-related API endpoints.",
  "vendor": "mljar",
  "product": "mercury",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 3.0.0, <= 3.2.3"
      ],
      "ecosystem": "pip",
      "fixed_versions": [
        "3.2.4"
      ],
      "package_name": "mercury",
      "purl": "pkg:pypi/mercury"
    }
  ],
  "cwes": [
    185
  ],
  "cvss_score": 10,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
  "epss_score": 0.0044,
  "epss_percentile": 0.3718,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": true,
  "pipeline_minutes": 15.95378815,
  "t0_at": "2026-10-19T16:04:07.065000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-19T16:51:37.772271+00:00",
      "days": 0.03299429711805556,
      "is_lower_bound": false,
      "measured_at": "2026-10-19T16:04:07.065000+00:00",
      "url": null
    },
    "exploit": {
      "at": "2026-10-19T16:51:37.772271+00:00",
      "days": 0.03299429711805556,
      "is_lower_bound": false,
      "measured_at": "2026-10-19T16:04:07.065000+00:00",
      "url": null
    },
    "public_poc": {
      "at": "2026-08-21T14:23:34+00:00",
      "days": -59.0698271412037,
      "is_lower_bound": false,
      "measured_at": "2026-10-19T16:04:07.065000+00:00",
      "url": "https://github.com/mljar/mercury/security/advisories/GHSA-f8c7-rwf9-fmgm"
    },
    "trigger_signal": {
      "at": "2026-10-19T16:04:07.065000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-19T16:04:07.065000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111057"
    }
  }
}