Improper Check for Dropped Privileges in jupyterhub - #VU162722
Published: November 9, 2026
Vulnerability identifier: #VU162722
CSH Severity: Low
CVSS v4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-273
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a highly privileged local attacker to access information protected by supplemental group memberships inherited from the JupyterHub process.
The vulnerability exists due to incomplete privilege dropping in JupyterHub's LocalProcessSpawner when the setgroups system call fails while spawning a user subprocess. A highly privileged local attacker can use a subprocess retaining the Hub's supplemental groups to read information outside the intended user's group permissions.
Affected software
jupyterhub
Remediation
Install security update from vendor's website.
jupyterhub - addressed in versions 5.5.3, 6.1.0