Detect CVE-2026-44180: Jupyter Enterprise Gateway ContainerProcessProxy._enforce_prohibited_ids Bypass in Microsoft Sentinel
CVE-2026-44180 is a critical (CVSS 9.8) input validation bypass in Jupyter Enterprise Gateway versions >= 2.0.0rc1 and < 3.3.0. The ContainerProcessProxy._enforce_prohibited_ids method fails to properly validate or enforce restrictions on kernel IDs, allowing an attacker to bypass container process isolation controls. This can enable unauthorized kernel spawning, container escape, or execution of arbitrary workloads within the enterprise gateway environment. A public proof-of-concept exists.
MITRE ATT&CK
KQL Detection Query
let SuspiciousKernelOps = DeviceProcessEvents
| where FileName in~ ("jupyter", "jupyter-enterprise-gateway", "python3", "python")
| where ProcessCommandLine has_any ("enterprise_gateway", "EnterpriseGateway", "ContainerProcessProxy")
| project TimeGenerated, DeviceId, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessCommandLine, FileName;
let NetworkActivity = DeviceNetworkEvents
| where InitiatingProcessFileName in~ ("jupyter", "python3", "python")
| where RemotePort in (8888, 8889, 9001, 9002)
| project TimeGenerated, DeviceId, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort, InitiatingProcessCommandLine;
SuspiciousKernelOps
| join kind=leftouter NetworkActivity on DeviceId, DeviceName
| where ProcessCommandLine has_any ("kernel_id", "--kernel-id", "enforce_prohibited", "prohibited_ids")
or ProcessCommandLine matches regex @"[?&]kernel[_-]id=[a-zA-Z0-9_\-]{8,}"
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, RemoteIP, RemotePortDetects suspicious Jupyter Enterprise Gateway process activity indicative of CVE-2026-44180 exploitation, including unusual kernel ID parameters and network connections from gateway processes.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate data science workflows spawning many kernels with custom IDs in dev environments
- Automated CI/CD pipelines running notebook tests via enterprise gateway
- Monitoring or health-check tooling that queries gateway endpoints on expected ports
Other platforms for CVE-2026-44180
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Spawn unauthorized kernel via ID bypass on vulnerable gateway
Expected signal: Process creation events for python3 spawned as child of jupyter-enterprise-gateway with command line containing the test kernel_id value; HTTP access log entries showing POST /api/kernels with status 201 for requests that should have been rejected
- Test 2Enumerate gateway kernel API for ID restriction bypass
Expected signal: Multiple sequential HTTP POST requests to /api/kernels gateway endpoint within a short timeframe with varying kernel_id values including path traversal and command injection patterns
- Test 3Simulate container escape via unrestricted kernel process spawning
Expected signal: Container process creation events showing python3 kernel process; if escape is successful, process events outside container namespace; file access events for /proc/1/cgroup or /etc/hosts from kernel process
Response Playbook
Triage
- Identify the affected host and confirm Jupyter Enterprise Gateway is installed; check the installed version with `pip show jupyter_enterprise_gateway` — versions >= 2.0.0rc1 and < 3.3.0 are vulnerable.
- Examine gateway process logs (typically in /var/log/ or the gateway's configured log directory) for unexpected kernel spawn requests, especially those with unusual or repeated kernel_id values.
- Review active containers or processes spawned by the gateway using `docker ps` or `kubectl get pods` to identify any unauthorized kernel workloads that may have been created through the bypass.
- Check network connections from the gateway process for unusual outbound traffic that might indicate a container escape or C2 communication initiated by exploited kernels.
Containment
- Immediately stop the Jupyter Enterprise Gateway service on affected hosts (`systemctl stop jupyter-enterprise-gateway` or equivalent) and block inbound connections to gateway ports (default 8888, 8889) via host firewall until patched.
- Isolate any containers spawned by the gateway that cannot be immediately attributed to legitimate users by stopping them with `docker stop <container_id>` or `kubectl delete pod <pod>` and preserving their state for forensic review.
Evidence Collection
- Capture full gateway application logs including access logs, error logs, and kernel lifecycle events for the period surrounding the incident to reconstruct the attack sequence.
- Collect memory and filesystem snapshots of any suspicious containers spawned by the gateway, including environment variables, mounted volumes, and network namespace state, to identify payload delivery or data exfiltration artifacts.
Escalation Criteria
- !Escalate immediately if evidence of successful container escape is found, including processes running outside expected container namespaces or unexpected privileged operations on the host.
- !Escalate if any spawned kernel containers have made outbound network connections to external IPs, which may indicate active C2 communication or data exfiltration following exploitation.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Jupyter Enterprise Gateway access logs showing kernel creation requests with anomalous or repeated kernel_id values in the request path or body - >
Container runtime logs (Docker daemon log or kubelet log) showing unexpected container creation events attributed to the gateway service account - >
Linux audit logs (auditd) recording execve calls for python processes spawned under the gateway user with command lines referencing ContainerProcessProxy or unusual kernel parameters
Tuning Guidance
Start with process command-line matching for enterprise_gateway and ContainerProcessProxy as high-signal indicators — these strings rarely appear in benign processes outside gateway hosts. Baseline the expected volume and cadence of kernel spawning in your environment before enabling count-based thresholds. In environments with many data scientists, expect high legitimate kernel volumes; tune by focusing on unusual kernel_id patterns (very long IDs, repeated identical IDs, or IDs containing special characters). Suppress alerts from known CI/CD service accounts and dedicated gateway service users after verifying their normal usage patterns. Correlate with network events for highest-fidelity detections.
Hunting Queries
Hunt for high-frequency or high-cardinality kernel ID usage on Jupyter Enterprise Gateway hosts, which may indicate automated exploitation or fuzzing of the prohibited ID bypass.
DeviceProcessEvents
| where FileName in~ ("python3", "python")
| where ProcessCommandLine has "enterprise_gateway"
| where ProcessCommandLine matches regex @"kernel[_-]id=[a-zA-Z0-9_\-]{8,}"
| summarize count(), make_set(ProcessCommandLine), make_set(AccountName) by DeviceName, bin(TimeGenerated, 1h)
| where count_ > 5index=* sourcetype IN ("linux_audit", "osquery") "enterprise_gateway"
| rex field=cmdline "kernel[_-]id=(?<kernel_id>[a-zA-Z0-9_\-]+)"
| where isnotnull(kernel_id)
| stats dc(kernel_id) as unique_kernel_ids count as total_requests by host, user
| where unique_kernel_ids > 10 OR total_requests > 50Atomic Red Team Tests
Simulate CVE-2026-44180 by sending a crafted kernel creation request with a prohibited kernel_id value that should be blocked by _enforce_prohibited_ids but is bypassed due to improper input validation.
Command
curl -s -X POST http://localhost:8888/api/kernels -H 'Content-Type: application/json' -d '{"name": "python3", "kernel_id": "../../../etc/passwd"}' && curl -s -X POST http://localhost:8888/api/kernels -H 'Content-Type: application/json' -d '{"name": "python3", "kernel_id": "PROHIBITED_TEST_ID_CVE_2026_44180"}'Cleanup
curl -s -X DELETE http://localhost:8888/api/kernels/$(curl -s http://localhost:8888/api/kernels | python3 -c "import sys,json; [print(k['id']) for k in json.load(sys.stdin)]" | head -1)Expected Telemetry
Process creation events for python3 spawned as child of jupyter-enterprise-gateway with command line containing the test kernel_id value; HTTP access log entries showing POST /api/kernels with status 201 for requests that should have been rejected
Expected Detection
Alert on kernel spawn request containing path traversal sequences or known-prohibited ID patterns; EDR should record the curl process and gateway's python child process with anomalous command-line arguments
Probe the gateway API to identify which kernel ID patterns are rejected versus accepted, simulating reconnaissance for the CVE-2026-44180 bypass.
Command
for id in 'normal-id-123' '../bypass' 'admin' 'root' '../../../../etc/shadow' 'kernel;id' 'kernel$(whoami)'; do echo -n "Testing ID: $id -> "; curl -s -o /dev/null -w '%{http_code}' -X POST http://localhost:8888/api/kernels -H 'Content-Type: application/json' -d "{\"name\": \"python3\", \"kernel_id\": \"$id\"}"; echo; doneCleanup
curl -s http://localhost:8888/api/kernels | python3 -c "import sys,json; [print(k['id']) for k in json.load(sys.stdin)]" | xargs -I{} curl -s -X DELETE http://localhost:8888/api/kernels/{}Expected Telemetry
Multiple sequential HTTP POST requests to /api/kernels gateway endpoint within a short timeframe with varying kernel_id values including path traversal and command injection patterns
Expected Detection
High-frequency kernel spawn requests from a single source IP; pattern matching on kernel_id values containing special characters or path traversal sequences in gateway access logs
After successfully spawning an unauthorized kernel via the bypass, execute a command inside the kernel container to test for host filesystem access, simulating post-exploitation container escape.
Command
KERNEL_ID=$(curl -s -X POST http://localhost:8888/api/kernels -H 'Content-Type: application/json' -d '{"name": "python3"}' | python3 -c "import sys,json; print(json.load(sys.stdin)['id'])"); sleep 2; python3 -c "import requests, json; ws_url='ws://localhost:8888/api/kernels/$KERNEL_ID/channels'; print('Kernel spawned:', '$KERNEL_ID'); print('Would execute: import os; os.system(\"cat /proc/1/cgroup\") # check if in container')"Cleanup
curl -s -X DELETE http://localhost:8888/api/kernels/$KERNEL_ID 2>/dev/null || trueExpected Telemetry
Container process creation events showing python3 kernel process; if escape is successful, process events outside container namespace; file access events for /proc/1/cgroup or /etc/hosts from kernel process
Expected Detection
EDR alert on kernel process accessing host-level procfs entries; container runtime alert on namespace violation if escape occurs; network detection on unexpected outbound connections from kernel container