Lack of user input validation in the file upload functionality of Open Notebook v1

CVE-2026-33589 is an authenticated arbitrary file-read bug in Open Notebook's source upload flow. In affected versions <= 1.8.3, the POST /api/sources path accepts a user-controlled file_path; when type=upload, that path is handed to the extraction pipeline without proving it stays under the uploads directory. Result: a logged-in user can request files like /etc/passwd or /proc/self/environ, and Open Notebook stores the contents as a readable Source in the UI.

The vendor's MEDIUM 6.5 is basically fair in real environments. The upside pressure is obvious: confidentiality loss is real, the exploit is simple, and the advisory explicitly calls out access to environment variables and secrets. The downside pressure is stronger for enterprise prioritization: this requires an authenticated application user, only hits self-hosted Open Notebook deployments, and the blast radius is usually bounded to what the containerized app can read rather than instant host takeover.

Why this verdict

• Post-auth only: exploitation requires a valid Open Notebook user or stolen session, which means this is not an unauthenticated edge compromise and should be scored below internet-reachable pre-auth bugs.
• Blast radius is usually container-bounded: the advisory shows arbitrary file read inside the Docker container, including /proc/self/environ; that is serious, but it is still limited by what the app process can read and what the operator mounted in.
• Exploit chain is simple once inside: no user interaction, low complexity, and ordinary API tooling are enough to weaponize it, so this should not be dismissed as harmless just because it is 'only' confidentiality impact.
• Population is narrow: Open Notebook is a popular open-source project but still a niche self-hosted application, not a ubiquitous enterprise control plane. That constrains fleet-level urgency even though individual exposed instances may hold sensitive research data and API secrets.
• No active exploitation signal: no KEV listing and no public evidence of live campaigns means there is no threat-intel amplifier forcing an emergency re-prioritization.

Why not higher?

To get into HIGH, I would want either unauthenticated reachability, widespread exposure, or credible exploitation evidence. This CVE has none of those. It also does not natively provide integrity damage, denial of service, or code execution; any broader fallout depends on what secrets happen to be readable in that specific deployment.

Why not lower?

This is still an easy, repeatable arbitrary file-read against a live web application, not a theoretical hardening nit. The advisory explicitly names /proc/self/environ, source code, config, and secrets as readable targets, so a compromised or malicious low-privilege user can absolutely turn this into meaningful data exposure on real systems.

1. Restrict Open Notebook to trusted users — Put the app behind SSO, MFA, VPN, or an internal reverse proxy and tighten who can create Sources. For a MEDIUM verdict there is no mitigation SLA — go straight to the 365-day remediation window, but this is cheap risk reduction and worth doing now on externally reachable instances.
2. Disable or gate source uploads where possible — If your deployment model allows it, temporarily remove upload capability for untrusted roles or collaborators until 1.8.4 is in place. There is no mitigation SLA for MEDIUM, but this is the most direct way to cut off the vulnerable code path without waiting for patch rollout.
3. Minimize secrets visible to the container — Move long-lived credentials out of broad environment variables, avoid unnecessary mounted files, and scope tokens to least privilege. This does not fix the bug, but it lowers the payoff if someone reads /proc/self/environ or adjacent config during the remediation window.
4. Audit recent Source creation activity — Review application and reverse-proxy logs for suspicious POST /api/sources requests and unexpected Source records that map to absolute paths or system files. Do this during normal remediation planning so you know whether you are dealing with a quiet patch job or an active investigation.
5. Prepare secret rotation for exposed instances — If you suspect exploitation, be ready to rotate API keys, database credentials, and any encryption-related secrets reachable from the container. For MEDIUM there is no formal mitigation deadline, but incident response should not wait on the longer remediation window if evidence appears.

Run this on the Docker host that runs Open Notebook, not from an auditor laptop. Invoke it as bash check_cve_2026_33589.sh for auto-detection or bash check_cve_2026_33589.sh <container_name_or_id> to target a specific container; it needs permission to talk to the Docker socket (root or a user in the docker group).

#!/usr/bin/env bash
# check_cve_2026_33589.sh
# Detects whether a running Open Notebook container is vulnerable to CVE-2026-33589.
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN / error

set -u

FIXED_VERSION="1.8.4"
TARGET="${1:-}"

version_le() {
  # returns 0 if $1 <= $2
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" = "$1" ]
}

normalize_ver() {
  local v="$1"
  v="${v#v}"
  v="${v%%-*}"
  printf '%s' "$v"
}

find_container() {
  docker ps --format '{{.ID}} {{.Image}} {{.Names}}' | awk '
    BEGIN{IGNORECASE=1}
    /open[_-]?notebook/ {print $1; exit}
  '
}

extract_version_from_image() {
  local cid="$1"
  local image tag
  image="$(docker inspect --format '{{.Config.Image}}' "$cid" 2>/dev/null)" || return 1
  tag="${image##*:}"
  if [ "$tag" = "$image" ]; then
    return 1
  fi
  tag="$(normalize_ver "$tag")"
  if [[ "$tag" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
    printf '%s' "$tag"
    return 0
  fi
  return 1
}

extract_version_from_container() {
  local cid="$1"
  local v

  # Try Python package metadata / module attributes inside the container.
  v="$(docker exec "$cid" sh -lc '
python3 - <<"PY"
import sys
try:
    try:
        from importlib import metadata as m
    except Exception:
        import importlib_metadata as m  # type: ignore
    for name in ("open-notebook", "open_notebook"):
        try:
            print(m.version(name))
            sys.exit(0)
        except Exception:
            pass
except Exception:
    pass
for stmt in (
    "from open_notebook import __version__ as v; print(v)",
    "import open_notebook, sys; print(getattr(open_notebook, \"__version__\", \"\"))",
):
    try:
        exec(stmt, {})
        sys.exit(0)
    except Exception:
        pass
sys.exit(1)
PY
' 2>/dev/null | tr -d '\r' | tail -n1)"

  if [ -n "$v" ]; then
    v="$(normalize_ver "$v")"
    if [[ "$v" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
      printf '%s' "$v"
      return 0
    fi
  fi

  # Fallback: look for package.json or pyproject version hints.
  v="$(docker exec "$cid" sh -lc '
for f in /app/package.json /app/pyproject.toml /app/open_notebook/pyproject.toml; do
  [ -f "$f" ] || continue
  grep -Eom1 '"version"[[:space:]]*:[[:space:]]*"[0-9]+\.[0-9]+\.[0-9]+"|version[[:space:]]*=[[:space:]]*"[0-9]+\.[0-9]+\.[0-9]+"' "$f" | grep -Eo '[0-9]+\.[0-9]+\.[0-9]+' && exit 0
done
exit 1
' 2>/dev/null | tr -d '\r' | tail -n1)"

  if [ -n "$v" ]; then
    printf '%s' "$v"
    return 0
  fi

  return 1
}

if ! command -v docker >/dev/null 2>&1; then
  echo "UNKNOWN: docker CLI not found"
  exit 2
fi

if [ -z "$TARGET" ]; then
  TARGET="$(find_container)"
fi

if [ -z "$TARGET" ]; then
  echo "UNKNOWN: no running Open Notebook container found"
  exit 2
fi

if ! docker inspect "$TARGET" >/dev/null 2>&1; then
  echo "UNKNOWN: container '$TARGET' not found"
  exit 2
fi

VERSION=""
VERSION="$(extract_version_from_container "$TARGET" 2>/dev/null)" || true
if [ -z "$VERSION" ]; then
  VERSION="$(extract_version_from_image "$TARGET" 2>/dev/null)" || true
fi

if [ -z "$VERSION" ]; then
  echo "UNKNOWN: could not determine Open Notebook version for container '$TARGET'"
  exit 2
fi

if version_le "$VERSION" "1.8.3"; then
  echo "VULNERABLE: Open Notebook version $VERSION detected in container '$TARGET' (fixed in $FIXED_VERSION)"
  exit 1
fi

if version_le "$FIXED_VERSION" "$VERSION"; then
  echo "PATCHED: Open Notebook version $VERSION detected in container '$TARGET'"
  exit 0
fi

echo "UNKNOWN: determined version '$VERSION' but comparison failed"
exit 2

Sources

1. NVD entry for CVE-2026-33589
2. GitHub advisory GHSA-842v-h4cj-r646
3. Open Notebook GitHub repository
4. Open Notebook project website
5. CISA Known Exploited Vulnerabilities Catalog
6. FIRST EPSS overview
7. FIRST EPSS daily data and stats