Jupyter-server vulnerabilities

Products

• Jupyter Server 15
• Enterprise Gateway 3

Newest

• jupyter-server jupyter server Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorization CVE-2026-114135 Fix available 8.8 HighOctober 21, 2026
• jupyter-server jupyter server Jupyter Server: 5xx request logging leaks token-bearing Referer header values CVE-2026-86049 Fix available 7.1 HighSeptember 17, 2026
• jupyter server, jupyter-server jupyter server, red hat migration toolkit for applications 8.2 +2 more +4 more Jupyter Server: Stored XSS in `NbconvertFileHandler` / `NbconvertPostHandler` via missing `sandbox` CSP CVE-2026-44727 Fix available 9.3 CriticalJune 18, 2026
• jupyter enterprise gateway Jupyter Enterprise Gateway Has Kubernetes Manifest Injection via Jinja2 Template Rendering CVE-2026-44182 Fix available 10.0 CriticalJune 3, 2026
• jupyter enterprise gateway Jupyter Enterprise Gateway: Jinja2 Template Server Side Template Injection results in Remote Code Execution CVE-2026-44181 Fix available 10.0 CriticalJune 3, 2026
• jupyter enterprise gateway Jupyter Enterprise Gateway: ContainerProcessProxy._enforce_prohibited_ids can be Bypassed CVE-2026-44180 Fix available 9.8 CriticalJune 3, 2026
• jupyter server, jupyter-server jupyter server +1 more jupyter-server authentication cookies remain valid after password reset due to static cookie secret CVE-2026-40934 Fix available 7.6 HighMay 5, 2026
• jupyter server, jupyter-server jupyter server, red hat migration toolkit for applications 8.2 +1 more +3 more jupyter-server CORS origin validation bypass via unanchored regex in allow_origin_pat CVE-2026-40110 Fix available 7.6 HighMay 5, 2026
• jupyter server, jupyter-server jupyter server, red hat migration toolkit for applications 8.2 +2 more +4 more jupyter-server path traversal allows access to sibling directories sharing root_dir name prefix CVE-2026-35397 Public exploitFix available 7.6 HighMay 5, 2026
• jupyter server, jupyter-server jupyter server +1 more jupyter_server next parameter open redirect can redirect users to external domains CVE-2025-61669 Fix available 6.3 MediumMay 5, 2026
• jupyter server, jupyter-server jupyter server +1 more Jupyter server on Windows discloses Windows user password hash CVE-2024-35178 Fix available 7.5 HighJune 6, 2024
• jupyter scheduler, jupyter-server jupyter-scheduler +1 more jupyter-scheduler's endpoint is missing authentication CVE-2024-28188 Fix available 5.3 MediumMay 23, 2024
• jupyter server, jupyter-server jupyter server +1 more Jupyter Server errors include tracebacks with path information CVE-2023-49080 Fix available 3.5 LowDecember 4, 2023
• jupyter server, jupyter-server jupyter server +1 more Open Redirect Vulnerability in jupyter-server CVE-2023-39968 Fix available 4.3 MediumAugust 28, 2023
• jupyter server, jupyter-server jupyter server +1 more cross-site inclusion (XSSI) of files in jupyter-server CVE-2023-40170 Fix available 4.6 MediumAugust 28, 2023
• jupyter server, jupyter-server jupyter server +1 more Known or guessable hidden files may be accessed in Jupyter Server CVE-2022-29241 Fix available 7.1 HighJune 14, 2022
• jupyter server, jupyter-server jupyter server +1 more Sensitive Auth & Cookie data stored in Jupyter server logs CVE-2022-24757 Fix available 7.5 HighMarch 23, 2022
• jupyter server, jupyter-server jupyter server +1 more Open redirect vulnerability CVE-2020-26275 Fix available 6.1 MediumDecember 21, 2020
• jupyter server, jupyter-server jupyter server +1 more Open redirect in Jupyter Server CVE-2020-26232 Fix available 4.1 MediumNovember 24, 2020