Vendor
Jupyterhub
24 known vulnerabilities in products by Jupyterhub, 0 of them actively exploited (CISA KEV).
Key figures
24
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
8
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2021-39159 | Remote code execution in Binderhub | 9.6 | |
| Critical | CVE-2021-39160 | Code injection in nbgitpuller | 9.6 | |
| Critical | CVE-2021-41194 | Improper Access Control in jupyterhub-firstuseauthenticator | 9.1 | |
| Critical | CVE-2024-28179 | Jupyter Server Proxy's Websocket Proxying does not require authentication | 9.1 | |
| Critical | CVE-2025-32428 | Jupyterhub Jupyter-remote-desktop-proxy: Exposure of Resource to Wrong Sphere | — | |
| High | CVE-2026-33175 | OAuthenticator: Authentication Bypass in Auth0OAuthenticator via Unverified Email Claims | 8.8 | |
| High | CVE-2020-15110 | Possible pod name collisions in jupyterhub-kubespawner | 6.8 | |
| Medium | CVE-2020-26250 | Base class whitelist configuration ignored in OAuthenticator | 6.3 | |
| High | CVE-2022-21697 | SSRF vulnerability (requires authentication) | 6.3 | |
| Critical | CVE-2024-35225 | Jupyter Server Proxy has a reflected XSS issue in host parameter | 9.7 | |
| Critical | CVE-2023-25574 | JupyterHub's LTI13Authenticator: JWT signature not validated | 10.0 | |
| High | CVE-2023-48311 | Any image allowed by default | 8.0 | |
| Critical | CVE-2024-29033 | Jupyterhub Oauthenticator: Improper Authorization | 7.5 | |
| Medium | CVE-2026-54338 | JupyterHub: Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login | 5.3 | |
| High | CVE-2024-41942 | JupyterHub has a privilege escalation vulnerability with the `admin:users` scope | 7.2 | |
| High | CVE-2024-37300 | Globus `identity_provider` restriction ignored when used with `allow_all` in JupyterHub 5.0 | 8.1 | |
| High | CVE-2020-26261 | user-readable api tokens in systemd units | 7.9 | |
| Medium | CVE-2026-108752 | JupyterHub through 6.0.1 OAuth Client ID Collision via Unescaped Hyphen | 4.2 | |
| Medium | CVE-2026-34052 | LTI JupyterHub Authenticator: Unbounded Memory Growth via Nonce Storage (Denial of Service) | 5.9 | |
| High | CVE-2024-28233 | XSS in JupyterHub via Self-XSS leveraged by Cookie Tossing | 8.1 | |
| Medium | CVE-2026-33709 | JupyterHub has an Open Redirect Vulnerability | 6.1 | |
| Medium | CVE-2026-40864 | JupyterHub: Cross-origin form POSTs bypass XSRF | 5.4 | |
| High | CVE-2021-41247 | incomplete logout in JupyterHub | 3.5 | |
| Medium | CVE-2022-31027 | Authorization Bypass Through User-Controlled Key when using CILogonOAuthenticator in oauthenticator | 4.2 |
Products
| Jupyterhub | 7 | 0 |
| Oauthenticator | 5 | 0 |
| Jupyter-server-proxy | 3 | 0 |