CVE-2020-26232
Open redirect in Jupyter Server
Jupyter Server before version 1.0.6 has an Open redirect vulnerability. A maliciously crafted link to a jupyter server could redirect the browser to a different website. All jupyter servers are technically affected, however, these maliciously crafted links can only be reasonably made for known jupyter server hosts. A link to your jupyter server may appear safe, but ultimately redirect to a spoofed server on the public internet.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Open redirect in Jupyter Server
Jupyter Server before version 1.0.6 has an Open redirect vulnerability. A maliciously crafted link to a jupyter server could redirect the browser to a different website. All jupyter servers are technically affected, however, these maliciously crafted links can only be reasonably made for known jupyter server hosts. A link to your jupyter server may appear safe, but ultimately redirect to a spoofed server on the public internet.
- Record
CVE-2020-26232- CVSS 3.1
- 4.1 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
EUVDEUVD-2020-0090
Jupyter Server before version 1.0.6 has an Open redirect vulnerability. A maliciously crafted link to a jupyter server could redirect the browser to a different website. All jupyter servers are technically affected, however, these maliciously crafted links can only be reasonably made for known jupyter server hosts. A link to your jupyter server may appear safe, but ultimately redirect to a spoofed server on the public internet.
- Record
EUVD-2020-0090- CVSS 3.1
- 4.1 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-grfj-wjv9-4f9v
Open redirect in Jupyter Server
Impact
What kind of vulnerability is it? Who is impacted?
Open redirect vulnerability - a maliciously crafted link to a jupyter server could redirect the browser to a different website.
All jupyter servers are technically affected, however, these maliciously crafted links can only be reasonably made for known jupyter server hosts. A link to your jupyter server may appear safe, but ultimately redirect to a spoofed server on the public internet.
This originated in jupyter/notebook: https://github.com/jupyter/notebook/security/advisories/GHSA-c7vm-f5p4-8fqh
Patches
Has the problem been patched? What versions should users upgrade to?
jupyter_server 1.0.6
References
For more information
If you have any questions or comments about this advisory, or vulnerabilities to report, please email our security list [email protected].
Credit: zhuonan li of Alibaba Application Security Team
- Record
GHSA-grfj-wjv9-4f9v- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N - CVSS 3.1
- 4.1 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
NVD
Jupyter Server before version 1.0.6 has an Open redirect vulnerability. A maliciously crafted link to a jupyter server could redirect the browser to a different website. All jupyter servers are technically affected, however, these maliciously crafted links can only be reasonably made for known jupyter server hosts. A link to your jupyter server may appear safe, but ultimately redirect to a spoofed server on the public internet.
- Record
CVE-2020-26232- CVSS 3.1
- 4.1 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N - CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 5.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
OSV
Jupyter Server before version 1.0.6 has an Open redirect vulnerability. A maliciously crafted link to a jupyter server could redirect the browser to a different website. All jupyter servers are technically affected, however, these maliciously crafted links can only be reasonably made for known jupyter server hosts. A link to your jupyter server may appear safe, but ultimately redirect to a spoofed server on the public internet.
- Record
CVE-2020-26232- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-26232
Jupyter Server before version 1.0.6 has an Open redirect vulnerability. A maliciously crafted link to a jupyter server could redirect the browser to a different website. All jupyter servers are technically affected, however, these maliciously crafted links can only be reasonably made for known jupyter server hosts. A link to your jupyter server may appear safe, but ultimately redirect to a spoofed server on the public internet.
- Record
DEBIAN-CVE-2020-26232- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
Show 5 moreShow less
OSVGHSA-grfj-wjv9-4f9v
Open redirect in Jupyter Server
Impact
What kind of vulnerability is it? Who is impacted?
Open redirect vulnerability - a maliciously crafted link to a jupyter server could redirect the browser to a different website.
All jupyter servers are technically affected, however, these maliciously crafted links can only be reasonably made for known jupyter server hosts. A link to your jupyter server may appear safe, but ultimately redirect to a spoofed server on the public internet.
This originated in jupyter/notebook: https://github.com/jupyter/notebook/security/advisories/GHSA-c7vm-f5p4-8fqh
Patches
Has the problem been patched? What versions should users upgrade to?
jupyter_server 1.0.6
References
For more information
If you have any questions or comments about this advisory, or vulnerabilities to report, please email our security list [email protected].
Credit: zhuonan li of Alibaba Application Security Team
- Record
GHSA-grfj-wjv9-4f9v- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N - CVSS 3.1
- 4.1 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11233-1 No score
python36-jupyter-server-1.10.2-1.2 on GA media
These are all security issues fixed in the python36-jupyter-server-1.10.2-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11233-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14143-1 No score
python310-jupyter-server-2.13.0-2.2 on GA media
These are all security issues fixed in the python310-jupyter-server-2.13.0-2.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14143-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:12012-1 No score
python313-jupyter-server-2.20.0-1.3 on GA media
These are all security issues fixed in the python313-jupyter-server-2.20.0-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12012-1- Updated
- 2026-11-02
OSVPYSEC-2020-234 No score
Jupyter Server before version 1.0.6 has an Open redirect vulnerability. A maliciously crafted link to a jupyter server could redirect the browser to a different website. All jupyter servers are technically affected, however, these maliciously crafted links can only be reasonably made for known jupyter server hosts. A link to your jupyter server may appear safe, but ultimately redirect to a spoofed server on the public internet.
- Record
PYSEC-2020-234- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
jupyter-serverPyPI |
before 1.0.6 | 1.0.6 |
jupyter-serverDebian:12 |
before 1.0.7-1 | 1.0.7-1 |
jupyter-serverDebian:13 |
before 1.0.7-1 | 1.0.7-1 |
jupyter-serverDebian:14 |
before 1.0.7-1 | 1.0.7-1 |
jupyter-serverPyPI |
before 1.0.6, plus listed versions 0.0.00.0.10.0.20.0.30.0.4 Show 29 moreShow less0.0.50.1.00.1.10.2.00.2.10.3.01.0.01.0.0rc01.0.0rc11.0.0rc101.0.0rc111.0.0rc121.0.0rc131.0.0rc141.0.0rc151.0.0rc161.0.0rc21.0.0rc31.0.0rc41.0.0rc51.0.0rc61.0.0rc71.0.0rc81.0.0rc91.0.11.0.21.0.31.0.41.0.5 |
1.0.6 |
python-jupyter-serveropenSUSE:Tumbleweed |
before 2.20.0-1.3 | 2.20.0-1.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-26232 is a medium vulnerability (CVSS 4.1) in Jupyter Server, published November 24, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.00%, the 63rd percentile. Fixed in jupyter-server 1.0.6.
References
github.com/jupyter/jupyter_server/security/advisories/GHSA-grfj-wjv9-4f9v
nvd.nist.gov/vuln/detail/CVE-2020-26232