CVE-2026-114135

### Summary Jupyter Server's gateway WebSocket handler checks that a user is authenticated, but it does not ask the configured Authorizer whether that user may execute kernels. In Jupyter Server 2.0.0 through 2.5.0, enabling GatewayClient.url automatically replaced the normal kernel channel handler with this gateway-specific handler. An authenticated user who is denied the `execute` action on the `kernels` resource can therefore still open a kernel channel and send messages to the upstream kernel. ### Details The normal handler performs the expected authorization check before creating the WebSocket connection: https://github.com/jupyter-server/jupyter_server/blob/v2.5.0/jupyter_server/services/kernels/websocket.py#L39-L47 The gateway handler only checks `current_user` and then opens the upstream channel. It never calls `authorizer.is_authorized(...)`: https://github.com/jupyter-server/jupyter_server/blob/v2.5.0/jupyter_server/gateway/handlers.py#L49-L75 https://github.com/jupyter-server/jupyter_server/blob/v2.5.0/jupyter_server/gateway/handlers.py#L87-L98 Gateway mode selected that handler automatically by replacing handlers with matching routes: https://github.com/jupyter-server/jupyter_server/blob/v2.5.0/jupyter_server/serverapp.py#L437-L446 PR #1261 stopped replacing the normal handler and routed gateway traffic through `GatewayWebSocketConnection` instead. This appears to have fixed the default gateway configuration in 2.6.0, although the deprecated handler is still present in current releases and can still be registered directly. https://github.com/jupyter-server/jupyter_server/pull/1261 ### Code-level validation 1. Configure a custom Authorizer that returns false for `execute` on `kernels` for a regular authenticated user. 2. Configure `GatewayClient.url` on Jupyter Server 2.0.0-2.5.0. 3. The normal `KernelWebsocketHandler` would reject that user with 403 in `pre_get`. 4. Gateway mode replaces it with `WebSocketChannelsHandler`. Its `authenticate`