CVE-2026-111058

Affected versions of the `mercury` package are vulnerable to Missing Authorization due to the Mercury server exposing the Jupyter kernel API to anonymous users without restricting the code they can run. `mercury_app/__main__.py` starts the JupyterLab server with `--IdentityProvider.token=''` and XSRF checks disabled when no `--token` or `MERCURY_TOKEN` is given, and while `mercury_app/block_handler.py` blocks `/lab`, `/api/terminals`, `/api/shutdown` and `/files`, the `/api/kernels` endpoint stays open because Mercury needs kernels to run notebooks, and `patch_kernel_websocket_handler()` forwards every message on the kernel websocket, `execute_request` included, without any check. An unauthenticated attacker who can reach a Mercury server running with the default tokenless configuration can create a kernel with `POST /api/kernels`, open its `/api/kernels/<id>/channels` websocket and send an `execute_request` that runs arbitrary Python code as the Mercury server process, leading to full compromise of the host or container.