CVE-2026-33709
JupyterHub has an Open Redirect Vulnerability
JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks. Prior to version 5.4.4, an open redirect vulnerability in JupyterHub allows attackers to construct links which, when clicked, take users to the JupyterHub login page, after which they are sent to an arbitrary attacker-controlled site outside JupyterHub instead of a JupyterHub page, bypassing JupyterHub's check to prevent this. This issue has been patched in version 5.4.4.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Active
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
JupyterHub has an Open Redirect Vulnerability
JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks. Prior to version 5.4.4, an open redirect vulnerability in JupyterHub allows attackers to construct links which, when clicked, take users to the JupyterHub login page, after which they are sent to an arbitrary attacker-controlled site outside JupyterHub instead of a JupyterHub page, bypassing JupyterHub's check to prevent this. This issue has been patched in version 5.4.4.
- Record
CVE-2026-33709- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-601
- Updated
- 2026-11-02
EUVDEUVD-2026-18880
JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks. Prior to version 5.4.4, an open redirect vulnerability in JupyterHub allows attackers to construct links which, when clicked, take users to the JupyterHub login page, after which they are sent to an arbitrary attacker-controlled site outside JupyterHub instead of a JupyterHub page, bypassing JupyterHub's check to prevent this. This issue has been patched in version 5.4.4.
- Record
EUVD-2026-18880- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-3vff-hjqv-m7h8
JupyterHub has an Open Redirect Vulnerability
Affected Version
JupyterHub <= 5.4.3
Impact
An open redirect vulnerability in JupyterHub <=5.4.3 allows attackers to construct links which, when clicked, take users to the JupyterHub login page, after which they are sent to an arbitrary attacker-controlled site outside JupyterHub instead of a JupyterHub page, bypassing JupyterHub's check to prevent this.
Patches
Upgrade to JupyterHub 5.4.4
Workarounds
A deployment can apply filters on the Location header in a reverse proxy such as nginx/apache/traefik.
- Record
GHSA-3vff-hjqv-m7h8- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
NVD
JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks. Prior to version 5.4.4, an open redirect vulnerability in JupyterHub allows attackers to construct links which, when clicked, take users to the JupyterHub login page, after which they are sent to an arbitrary attacker-controlled site outside JupyterHub instead of a JupyterHub page, bypassing JupyterHub's check to prevent this. This issue has been patched in version 5.4.4.
- Record
CVE-2026-33709- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
OSV
JupyterHub has an Open Redirect Vulnerability
JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks. Prior to version 5.4.4, an open redirect vulnerability in JupyterHub allows attackers to construct links which, when clicked, take users to the JupyterHub login page, after which they are sent to an arbitrary attacker-controlled site outside JupyterHub instead of a JupyterHub page, bypassing JupyterHub's check to prevent this. This issue has been patched in version 5.4.4.
- Record
CVE-2026-33709- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-601
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-33709
JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks. Prior to version 5.4.4, an open redirect vulnerability in JupyterHub allows attackers to construct links which, when clicked, take users to the JupyterHub login page, after which they are sent to an arbitrary attacker-controlled site outside JupyterHub instead of a JupyterHub page, bypassing JupyterHub's check to prevent this. This issue has been patched in version 5.4.4.
- Record
DEBIAN-CVE-2026-33709- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
Show 4 moreShow less
OSVGHSA-3vff-hjqv-m7h8
JupyterHub has an Open Redirect Vulnerability
Affected Version
JupyterHub <= 5.4.3
Impact
An open redirect vulnerability in JupyterHub <=5.4.3 allows attackers to construct links which, when clicked, take users to the JupyterHub login page, after which they are sent to an arbitrary attacker-controlled site outside JupyterHub instead of a JupyterHub page, bypassing JupyterHub's check to prevent this.
Patches
Upgrade to JupyterHub 5.4.4
Workarounds
A deployment can apply filters on the Location header in a reverse proxy such as nginx/apache/traefik.
- Record
GHSA-3vff-hjqv-m7h8- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
OSVPYSEC-2026-2188
JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks. Prior to version 5.4.4, an open redirect vulnerability in JupyterHub allows attackers to construct links which, when clicked, take users to the JupyterHub login page, after which they are sent to an arbitrary attacker-controlled site outside JupyterHub instead of a JupyterHub page, bypassing JupyterHub's check to prevent this. This issue has been patched in version 5.4.4.
- Record
PYSEC-2026-2188- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-33709
JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks. Prior to version 5.4.4, an open redirect vulnerability in JupyterHub allows attackers to construct links which, when clicked, take users to the JupyterHub login page, after which they are sent to an arbitrary attacker-controlled site outside JupyterHub instead of a JupyterHub page, bypassing JupyterHub's check to prevent this. This issue has been patched in version 5.4.4.
- Record
UBUNTU-CVE-2026-33709- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVBIT-jupyterhub-2026-33709 No score
JupyterHub has an Open Redirect Vulnerability
JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks. Prior to version 5.4.4, an open redirect vulnerability in JupyterHub allows attackers to construct links which, when clicked, take users to the JupyterHub login page, after which they are sent to an arbitrary attacker-controlled site outside JupyterHub instead of a JupyterHub page, bypassing JupyterHub's check to prevent this. This issue has been patched in version 5.4.4.
- Record
BIT-jupyterhub-2026-33709- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
jupyterhubPyPI |
through 5.4.3 | 5.4.4 |
jupyterhubBitnami |
before 5.4.4 | 5.4.4 |
jupyterhubDebian:12 |
All versions, plus listed versions 3.0.0+ds1-15.0.0+ds1-15.0.0+ds1-25.0.0+ds1-35.0.0+ds1-4 Show 5 moreShow less5.2.1+ds1-15.2.1+ds1-25.2.1+ds1-35.2.1+ds1-45.2.1+ds1-5 |
None known |
jupyterhubDebian:13 |
All versions, plus listed versions 5.2.1+ds1-45.2.1+ds1-5 |
None known |
jupyterhubDebian:14 |
All versions, plus listed versions 5.2.1+ds1-45.2.1+ds1-5 |
None known |
jupyterhubPyPI |
before 5.4.4, plus listed versions 0.1.00.2.00.3.00.4.00.4.1 Show 45 moreShow less0.5.00.6.00.6.10.7.00.7.0b10.7.10.7.20.8.00.8.0b10.8.0b20.8.0b30.8.0b40.8.0b50.8.0rc10.8.0rc20.8.10.9.00.9.0b10.9.0b20.9.0b30.9.0rc10.9.10.9.20.9.30.9.40.9.50.9.61.0.01.0.0b11.0.0b21.1.01.1.0b11.2.01.2.0b11.2.11.2.21.3.01.4.01.4.11.4.21.5.01.5.12.0.02.0.0b12.0.0b2 |
5.4.4 |
jupyterhubUbuntu:22.04:LTS |
All versions, plus listed versions 2.0.0+ds1-12.0.0+ds1-2 |
None known |
jupyterhubUbuntu:24.04:LTS |
All versions, plus listed versions 3.0.0+ds1-1 |
None known |
jupyterhubUbuntu:25.10 |
All versions, plus listed versions 5.2.1+ds1-25.2.1+ds1-35.2.1+ds1-4 |
None known |
jupyterhubUbuntu:26.10 |
All versions, plus listed versions 5.2.1+ds1-45.2.1+ds1-5 |
None known |
jupyterhubUbuntu:26.04:LTS |
All versions, plus listed versions 5.2.1+ds1-4 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-33709 is a medium vulnerability (CVSS 5.1) in Jupyter Jupyterhub, published April 3, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 11th percentile. Fixed in jupyterhub 5.4.4.
References
github.com/jupyterhub/jupyterhub/security/advisories/GHSA-3vff-hjqv-m7h8
nvd.nist.gov/vuln/detail/CVE-2026-33709
security-tracker.debian.org/tracker/CVE-2026-33709
ubuntu.com/security/CVE-2026-33709
cve.org/CVERecord?id=CVE-2026-33709
Left out here: 43 versions. The JSON record has them.