ETK-2026-2650Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-2650",
  "cve_id": null,
  "display_id": "ETK-2026-2650",
  "ghsa_id": "GHSA-w823-3v59-v22p",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Missing access checks in Mercury standalone notebook handler",
  "summary": "Mercury standalone versions later than 3.0 through 3.2.11 can expose notebooks and their saved outputs through the notebook contents handler. An unauthenticated remote client may read content when the server permits unauthenticated access, including deployments otherwise configured with a token or password. Normal JupyterLab extension mode is not affected.",
  "mitigation": "Upgrade Mercury to version 3.2.12 or later, then restart Mercury servers and replace deployed runtime images. Until upgraded, set `ServerApp.allow_unauthenticated_access=False` for protected servers.",
  "vendor": "pip",
  "product": "mercury",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "> 3.0, <= 3.2.11"
      ],
      "ecosystem": "pip",
      "fixed_versions": [
        "3.2.12"
      ],
      "package_name": "mercury",
      "purl": "pkg:pypi/mercury"
    }
  ],
  "cwes": [
    306
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 11.0720883,
  "t0_at": null,
  "signals": {
    "trigger_signal": {
      "at": "2026-10-26T09:15:56+00:00",
      "days": -0.3339293657060185,
      "is_lower_bound": true,
      "measured_at": "2026-10-26T17:16:47.541810+00:00",
      "url": "https://github.com/mljar/mercury/security/advisories/GHSA-w823-3v59-v22p"
    }
  }
}