Jupyterhub vulnerabilities

Products

• Jupyterhub 7
• Oauthenticator 5
• Jupyter-server-proxy 3
• Ltiauthenticator 2

Newest

• jupyterhub JupyterHub through 6.0.1 OAuth Client ID Collision via Unescaped Hyphen CVE-2026-108752 Fix available 2.3 LowOctober 11, 2026
• jupyterhub JupyterHub: Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login CVE-2026-54338 Fix available 5.3 MediumAugust 7, 2026
• jupyter jupyterhub JupyterHub: Cross-origin form POSTs bypass XSRF CVE-2026-40864 Public exploitFix available 5.4 MediumMay 5, 2026
• jupyter lti jupyterhub authenticator, jupyterhub ltiauthenticator +1 more LTI JupyterHub Authenticator: Unbounded Memory Growth via Nonce Storage (Denial of Service) CVE-2026-34052 Fix available 5.9 MediumApril 3, 2026
• jupyter jupyterhub JupyterHub has an Open Redirect Vulnerability CVE-2026-33709 Fix available 5.1 MediumApril 3, 2026
• jupyter oauthenticator OAuthenticator: Authentication Bypass in Auth0OAuthenticator via Unverified Email Claims CVE-2026-33175 Fix available 8.8 HighApril 3, 2026
• jupyterhub jupyter-remote-desktop-proxy Jupyter Remote Desktop Proxy makes TigerVNC accessible via the network and not just via a UNIX socket as intended CVE-2025-32428 Fix available 9.0 CriticalApril 12, 2025
• jupyterhub ltiauthenticator, jupyter lti jupyterhub authenticator +1 more JupyterHub's LTI13Authenticator: JWT signature not validated CVE-2023-25574 Fix available 10.0 CriticalFebruary 25, 2025
• jupyter jupyterhub JupyterHub has a privilege escalation vulnerability with the `admin:users` scope CVE-2024-41942 Fix available 7.2 HighAugust 8, 2024
• jupyterhub oauthenticator Globus `identity_provider` restriction ignored when used with `allow_all` in JupyterHub 5.0 CVE-2024-37300 Fix available 8.1 HighJune 12, 2024
• jupyter server proxy, jupyterhub jupyter-server-proxy, jupyter server proxy +2 more Jupyter Server Proxy has a reflected XSS issue in host parameter CVE-2024-35225 Fix available 9.7 CriticalJune 11, 2024
• jupyter jupyterhub XSS in JupyterHub via Self-XSS leveraged by Cookie Tossing CVE-2024-28233 Fix available 8.1 HighMarch 27, 2024
• jupyter oauthenticator GoogleOAuthenticator.hosted_domain incorrectly verifies membership of an Google organization/workspace CVE-2024-29033 Fix available 7.5 HighMarch 20, 2024
• jupyter server proxy, jupyterhub jupyter-server-proxy +1 more Jupyter Server Proxy's Websocket Proxying does not require authentication CVE-2024-28179 Fix available 9.1 CriticalMarch 20, 2024
• jupyter dockerspawner Any image allowed by default CVE-2023-48311 Fix available 8.0 HighDecember 8, 2023
• jupyter oauthenticator Authorization Bypass Through User-Controlled Key when using CILogonOAuthenticator in oauthenticator CVE-2022-31027 Fix available 4.2 MediumJune 6, 2022
• jupyter server proxy, jupyterhub jupyter-server-proxy +1 more SSRF vulnerability (requires authentication) CVE-2022-21697 Fix available 6.3 MediumJanuary 25, 2022
• jupyter jupyterhub incomplete logout in JupyterHub CVE-2021-41247 Fix available 3.5 LowNovember 4, 2021
• jupyterhub firstuseauthenticator, first use authenticator +1 more Improper Access Control in jupyterhub-firstuseauthenticator CVE-2021-41194 Fix available 9.1 CriticalOctober 28, 2021
• jupyter binderhub Remote code execution in Binderhub CVE-2021-39159 Fix available 9.6 CriticalAugust 25, 2021
• jupyterhub nbgitpuller Code injection in nbgitpuller CVE-2021-39160 Fix available 9.6 CriticalAugust 25, 2021
• jupyterhub systemdspawner user-readable api tokens in systemd units CVE-2020-26261 Fix available 7.9 HighDecember 9, 2020
• jupyter oauthenticator Base class whitelist configuration ignored in OAuthenticator CVE-2020-26250 Fix available 6.3 MediumDecember 1, 2020
• jupyterhub kubespawner Possible pod name collisions in jupyterhub-kubespawner CVE-2020-15110 Fix available 6.8 MediumJuly 17, 2020