Every CVE Search/ Get API key

CVE-2024-28188

jupyter-scheduler's endpoint is missing authentication

5.3 MediumFix available

Jupyter Scheduler is collection of extensions for programming jobs to run now or run on a schedule. The list of conda environments of jupyter-scheduler users maybe be exposed, potentially revealing information about projects that a specific user may be working on. This vulnerability has been patched in version(s) 1.1.6, 1.2.1, 1.8.2 and 2.5.2.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

0.33%Up 0.3 points since May 24, 2024
90%50%10%1%

What each source reports

CVE List Score used 5.3

jupyter-scheduler's endpoint is missing authentication

Jupyter Scheduler is collection of extensions for programming jobs to run now or run on a schedule. The list of conda environments of jupyter-scheduler users maybe be exposed, potentially revealing information about projects that a specific user may be working on. This vulnerability has been patched in version(s) 1.1.6, 1.2.1, 1.8.2 and 2.5.2.

Record
CVE-2024-28188
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-200, CWE-287
Updated
2026-11-02
EUVDEUVD-2024-1797 5.3

Jupyter Scheduler is collection of extensions for programming jobs to run now or run on a schedule. The list of conda environments of jupyter-scheduler users maybe be exposed, potentially revealing information about projects that a specific user may be working on. This vulnerability has been patched in version(s) 1.1.6, 1.2.1, 1.8.2 and 2.5.2.

Record
EUVD-2024-1797
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-v9g2-g7j4-4jxc 5.3

jupyter-scheduler's endpoint is missing authentication

Impact

jupyter_scheduler is missing an authentication check in Jupyter Server on an API endpoint (GET /scheduler/runtime_environments) which lists the names of the Conda environments on the server. In affected versions, jupyter_scheduler allows an unauthenticated user to obtain the list of Conda environment names on the server. This reveals any information that may be present in a Conda environment name.

This issue does not allow an unauthenticated third party to read, modify, or enter the Conda environments present on the server where jupyter_scheduler is running. This issue only reveals the list of Conda environment names.

Impacted versions: >=1.0.0,<=1.1.5 ; ==1.2.0 ; >=1.3.0,<=1.8.1 ; >=2.0.0,<=2.5.1

Patches

  • jupyter-scheduler==1.1.6
  • jupyter-scheduler==1.2.1
  • jupyter-scheduler==1.8.2
  • jupyter-scheduler==2.5.2

Workarounds

Server operators who are unable to upgrade can disable the jupyter-scheduler extension with:

jupyter server extension disable jupyter-scheduler

References

If you have any questions or comments about this advisory we ask that you contact AWS/Amazon Security via our vulnerability reporting page [1] or directly via email to [email protected]. Please do not create a public GitHub issue.

[1] Vulnerability reporting page: https://aws.amazon.com/security/vulnerability-reporting

Record
GHSA-v9g2-g7j4-4jxc
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-200, CWE-287
Updated
2026-11-02
NVD 5.3

Jupyter Scheduler is collection of extensions for programming jobs to run now or run on a schedule. The list of conda environments of jupyter-scheduler users maybe be exposed, potentially revealing information about projects that a specific user may be working on. This vulnerability has been patched in version(s) 1.1.6, 1.2.1, 1.8.2 and 2.5.2.

Record
CVE-2024-28188
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-200, CWE-287
Updated
2026-11-02
OSV 5.3

jupyter-scheduler's endpoint is missing authentication

Jupyter Scheduler is collection of extensions for programming jobs to run now or run on a schedule. The list of conda environments of jupyter-scheduler users maybe be exposed, potentially revealing information about projects that a specific user may be working on. This vulnerability has been patched in version(s) 1.1.6, 1.2.1, 1.8.2 and 2.5.2.

Record
CVE-2024-28188
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-200, CWE-287
Updated
2026-11-02
OSVGHSA-v9g2-g7j4-4jxc 5.3

jupyter-scheduler's endpoint is missing authentication

Impact

jupyter_scheduler is missing an authentication check in Jupyter Server on an API endpoint (GET /scheduler/runtime_environments) which lists the names of the Conda environments on the server. In affected versions, jupyter_scheduler allows an unauthenticated user to obtain the list of Conda environment names on the server. This reveals any information that may be present in a Conda environment name.

This issue does not allow an unauthenticated third party to read, modify, or enter the Conda environments present on the server where jupyter_scheduler is running. This issue only reveals the list of Conda environment names.

Impacted versions: >=1.0.0,<=1.1.5 ; ==1.2.0 ; >=1.3.0,<=1.8.1 ; >=2.0.0,<=2.5.1

Patches

  • jupyter-scheduler==1.1.6
  • jupyter-scheduler==1.2.1
  • jupyter-scheduler==1.8.2
  • jupyter-scheduler==2.5.2

Workarounds

Server operators who are unable to upgrade can disable the jupyter-scheduler extension with:

jupyter server extension disable jupyter-scheduler

References

If you have any questions or comments about this advisory we ask that you contact AWS/Amazon Security via our vulnerability reporting page [1] or directly via email to [email protected]. Please do not create a public GitHub issue.

[1] Vulnerability reporting page: https://aws.amazon.com/security/vulnerability-reporting

Record
GHSA-v9g2-g7j4-4jxc
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-200, CWE-287
Updated
2026-11-02
OSVPYSEC-2026-1479 5.3

jupyter-scheduler's endpoint is missing authentication

Impact

jupyter_scheduler is missing an authentication check in Jupyter Server on an API endpoint (GET /scheduler/runtime_environments) which lists the names of the Conda environments on the server. In affected versions, jupyter_scheduler allows an unauthenticated user to obtain the list of Conda environment names on the server. This reveals any information that may be present in a Conda environment name.

This issue does not allow an unauthenticated third party to read, modify, or enter the Conda environments present on the server where jupyter_scheduler is running. This issue only reveals the list of Conda environment names.

Impacted versions: >=1.0.0,<=1.1.5 ; ==1.2.0 ; >=1.3.0,<=1.8.1 ; >=2.0.0,<=2.5.1

Patches

  • jupyter-scheduler==1.1.6
  • jupyter-scheduler==1.2.1
  • jupyter-scheduler==1.8.2
  • jupyter-scheduler==2.5.2

Workarounds

Server operators who are unable to upgrade can disable the jupyter-scheduler extension with:

jupyter server extension disable jupyter-scheduler

References

If you have any questions or comments about this advisory we ask that you contact AWS/Amazon Security via our vulnerability reporting page [1] or directly via email to [email protected]. Please do not create a public GitHub issue.

[1] Vulnerability reporting page: https://aws.amazon.com/security/vulnerability-reporting

Record
PYSEC-2026-1479
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2024-28188 5.3

Jupyter Scheduler is collection of extensions for programming jobs to run now or run on a schedule. The list of conda environments of jupyter-scheduler users maybe be exposed, potentially revealing information about projects that a specific user may be working on. This vulnerability has been patched in version(s) 1.1.6, 1.2.1, 1.8.2 and 2.5.2.

Record
UBUNTU-CVE-2024-28188
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
jupyter-scheduler
PyPI
 1.0.0 up to 1.1.6
1.1.6
jupyter-scheduler
PyPI
 1.2.0 to 1.2.0
1.2.1
jupyter-scheduler
PyPI
 1.3.0 up to 1.8.2
1.8.2
jupyter-scheduler
PyPI
 2.0.0 up to 2.5.2
2.5.2
jupyter-scheduler
PyPI
 1.0.0 up to 1.1.6, plus listed versions
1.1.01.1.11.1.21.1.31.1.41.1.5
1.1.6
jupyter-scheduler
PyPI
 1.2.0 up to 1.2.1
1.2.1
jupyter-scheduler
PyPI
 1.3.0 up to 1.8.2, plus listed versions
1.3.11.3.21.3.31.3.41.4.0
Show 5 moreShow less
1.5.01.6.01.7.01.8.01.8.1
1.8.2
jupyter-scheduler
PyPI
 2.0.0 up to 2.5.2, plus listed versions
2.1.02.2.02.3.02.4.02.5.02.5.1
2.5.2
jupyter-scheduler
PyPI
 1.0.0 up to 1.1.6, 1.2.0 up to 1.2.1, 1.3.0 up to 1.8.2, 2.0.0 up to 2.5.2, plus listed versions
1.1.01.1.11.1.21.1.31.1.4
Show 17 moreShow less
1.1.51.3.11.3.21.3.31.3.41.4.01.5.01.6.01.7.01.8.01.8.12.1.02.2.02.3.02.4.02.5.02.5.1
1.1.61.2.11.8.22.5.2
jupyter-server
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.2.2-11.13.1-1
 None known
Show 4 moreShow less
Affected packages
PackageAffectedFixed
jupyter-server
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.23.3-11.23.3-2
 None known
jupyter-server
Ubuntu:25.10
 All versions, plus listed versions
2.14.2-52.15.0-1
 None known
jupyter-server
Ubuntu:26.10
 All versions, plus listed versions
2.17.0-12.20.0-3
 None known
jupyter-server
Ubuntu:26.04:LTS
 All versions, plus listed versions
2.15.0-12.17.0-1
 None known

History

History
RecordedChangedSources
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-28188 is a medium vulnerability (CVSS 5.3) in Jupyter Scheduler, published May 23, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 26th percentile. Fixed in jupyter-scheduler 1.1.6.

References

Show 7 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open