SB2026110971 - Multiple vulnerabilities in jupyterhub

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026110971

SB2026110971 - Multiple vulnerabilities in jupyterhub

Published: November 9, 2026

Security Bulletin ID SB2026110971
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 6
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 33% Low 67%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 6 vulnerabilities.


1) Improper Validation of Specified Quantity in Input (CVE-ID: N/A)

CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an authenticated remote attacker to create non-expiring JupyterHub tokens despite a configured maximum token lifetime.

The vulnerability exists due to inconsistent validation of the expires_in field when token_expires_in_max_seconds requires expiration, with zero accepted during validation but treated as no expiration during token creation. An authenticated remote attacker can submit a token creation request with expires_in set to zero to bypass the expiration policy.


2) Input validation error (CVE-ID: N/A)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated attacker with low privileges to cause a denial of service that prevents JupyterHub launches.

The vulnerability exists due to improper handling of certain invalid user input in JupyterHub spawner options that leaves invalid data in the database. A remote authenticated attacker with low privileges can submit these invalid options and prevent subsequent launches until manual database intervention removes the invalid data.


3) Input validation error (CVE-ID: N/A)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a low-privileged attacker to gain administrator access to JupyterHub through a process requiring interaction by an administrator.

The vulnerability exists due to missing username normalization in SharedPasswordAuthenticator when the authenticator is configured with admin_users. A low-privileged attacker can exploit this normalization failure, with administrator interaction, to elevate their own account privileges.


4) Input validation error (CVE-ID: N/A)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an administrator with permission to rename users to create invalid usernames that may lead to cross-site scripting.

The vulnerability exists due to missing username validation in JupyterHub's administrative API when an existing user is renamed. An administrator with permission to rename users can submit a crafted username that could execute script in another user's browser when that user views affected content.


5) Input validation error (CVE-ID: N/A)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to interfere with URL handling in JupyterHub deployments that permit users to sign up with arbitrary usernames.

The vulnerability exists due to insufficient validation of user and service names used as URL components in JupyterHub. A remote attacker can register an account with a malicious username to trigger the URL handling interference.


6) Improper Check for Dropped Privileges (CVE-ID: N/A)

CWE-ID: CWE-273 - Improper Check for Dropped Privileges

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a highly privileged local attacker to access information protected by supplemental group memberships inherited from the JupyterHub process.

The vulnerability exists due to incomplete privilege dropping in JupyterHub's LocalProcessSpawner when the setgroups system call fails while spawning a user subprocess. A highly privileged local attacker can use a subprocess retaining the Hub's supplemental groups to read information outside the intended user's group permissions.


Remediation

Install update from vendor's website.

References