Jupyterhub
23 CVEs across 12 Jupyterhub products. Browse Jupyterhub vulnerabilities, severities, and proof-of-concept exploits.
Jupyterhub products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-54338 | Medium | 5.3 | 2026-08-07 | JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators… |
CVE-2026-40864 | Medium | 5.4 | 2026-05-22 | JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. In versions 4.1.0 through 5.4.4, XSRF protection (updated in 4.1… |
CVE-2026-34052 | Medium | 5.9 | 2026-04-03 | LTI JupyterHub Authenticator is a JupyterHub authenticator for LTI. Prior to version 1.6.3, the LTI 1.1 validator stores OAuth nonces in a class-level dictiona… |
CVE-2026-33709 | Medium | 6.1 | 2026-04-03 | JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks. Prior to version 5.4.4, an open redirect vulnerability in JupyterHu… |
CVE-2026-33175 | High | 8.8 | 2026-04-03 | OAuthenticator is software that allows OAuth2 identity providers to be plugged in and used with JupyterHub. Prior to version 17.4.0, an authentication bypass v… |
CVE-2025-32428 | | 2025-04-15 | Jupyter Remote Desktop Proxy allows you to run a Linux Desktop on a JupyterHub. jupyter-remote-desktop-proxy was meant to rely on UNIX sockets readable only by… | |
CVE-2023-25574 | Critical | 10.0 | 2025-02-25 | `jupyterhub-ltiauthenticator` is a JupyterHub authenticator for learning tools interoperability (LTI). LTI13Authenticator that was introduced in `jupyterhub-lt… |
CVE-2024-41942 | High | 7.2 | 2024-08-08 | JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks. Prior to versions 4.1.6 and 5.1.0, if a user is granted the `admin… |
CVE-2024-37300 | High | 8.1 | 2024-06-12 | OAuthenticator is software that allows OAuth2 identity providers to be plugged in and used with JupyterHub. JupyterHub < 5.0, when used with `GlobusOAuthentica… |
CVE-2024-35225 | Critical | 9.6 | 2024-06-11 | Jupyter Server Proxy allows users to run arbitrary external processes alongside their notebook server and provide authenticated web access to them. Versions of… |
CVE-2024-28233 | High | 8.1 | 2024-03-27 | JupyterHub is an open source multi-user server for Jupyter notebooks. By tricking a user into visiting a malicious subdomain, the attacker can achieve an XSS d… |
CVE-2024-29033 | High | 7.5 | 2024-03-20 | OAuthenticator provides plugins for JupyterHub to use common OAuth providers, as well as base classes for writing one's own Authenticators with any OAuth 2.0 p… |
CVE-2024-28179 | Critical | 9.0 | 2024-03-20 | Jupyter Server Proxy allows users to run arbitrary external processes alongside their Jupyter notebook servers and provides authenticated web access. Prior to… |
CVE-2023-48311 | High | 8.0 | 2023-12-08 | dockerspawner is a tool to spawn JupyterHub single user servers in Docker containers. Users of JupyterHub deployments running DockerSpawner starting with 0.11… |
CVE-2022-31027 | Medium | 4.2 | 2022-06-09 | OAuthenticator is an OAuth token library for the JupyerHub login handler. CILogonOAuthenticator is provided by the OAuthenticator package, and lets users log i… |
CVE-2022-21697 | Medium | 6.3 | 2022-01-25 | Jupyter Server Proxy is a Jupyter notebook server extension to proxy web services. Versions of Jupyter Server Proxy prior to 3.2.1 are vulnerable to Server-Sid… |
CVE-2021-41247 | Low | 3.5 | 2021-11-04 | JupyterHub is an open source multi-user server for Jupyter notebooks. In affected versions users who have multiple JupyterLab tabs open in the same browser ses… |
CVE-2021-41194 | Critical | 9.1 | 2021-10-28 | FirstUseAuthenticator is a JupyterHub authenticator that helps new users set their password on their first login to JupyterHub. When JupyterHub is used with Fi… |
CVE-2021-39159 | Critical | 9.6 | 2021-08-25 | BinderHub is a kubernetes-based cloud service that allows users to share reproducible interactive computing environments from code repositories. In affected ve… |
CVE-2021-39160 | Critical | 9.6 | 2021-08-25 | nbgitpuller is a Jupyter server extension to sync a git repository one-way to a local path. Due to unsanitized input, visiting maliciously crafted links could… |
CVE-2020-26261 | High | 7.9 | 2020-12-09 | jupyterhub-systemdspawner enables JupyterHub to spawn single-user notebook servers using systemd. In jupyterhub-systemdspawner before version 0.15 user API tok… |
CVE-2020-26250 | Medium | 6.3 | 2020-12-01 | OAuthenticator is an OAuth login mechanism for JupyterHub. In oauthenticator from version 0.12.0 and before 0.12.2, the deprecated (in jupyterhub 1.2) configur… |
CVE-2020-15110 | Medium | 6.8 | 2020-07-17 | In jupyterhub-kubespawner before 0.12, certain usernames will be able to craft particular server names which will grant them access to the default server of ot… |