---
id: CVE-2021-41247
aliases:
  - GHSA-cw7p-q79f-m2v7
  - BIT-jupyterhub-2021-41247
  - PYSEC-2021-386
title: incomplete JupyterHub logout with simultaneous JupyterLab sessions
summary: incomplete JupyterHub logout with simultaneous JupyterLab sessions
severity: low
cvss: 3.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N'
vendor: jupyterhub
product: jupyterhub
ecosystem: pip
affected:
  - 'jupyterhub >= 1.0.0, < 1.5.0'
patched:
  - jupyterhub 1.5.0
published: '2021-11-08'
updated: '2026-07-08'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-cw7p-q79f-m2v7'
references:
  - url: >-
      https://github.com/jupyterhub/jupyterhub/security/advisories/GHSA-cw7p-q79f-m2v7
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2021-41247'
  - url: >-
      https://github.com/jupyterhub/jupyterhub/commit/5ac9e7f73a6e1020ffddc40321fc53336829fe27
  - url: 'https://github.com/jupyterhub/jupyterhub'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/jupyterhub/PYSEC-2021-386.yaml
tags:
  - osv
  - pip
epss: 0.00804
epssPercentile: 0.55248
ingestedAt: '2026-07-08T18:25:48.593Z'
---

## Overview

### Impact

Users of JupyterLab with JupyterHub who have multiple JupyterLab tabs open in the same browser session, may see incomplete logout from the single-user server, as fresh credentials (for the single-user server only, not the Hub) reinstated after logout, if another active JupyterLab session is open while the logout takes place.

### Patches

Upgrade to JupyterHub 1.5. For distributed deployments, it is jupyterhub in the _user_ environment that needs patching. There are no patches necessary in the Hub environment.

### Workarounds

The only workaround is to make sure that only one JupyterLab tab is open when you log out.

## Affected packages

- `jupyterhub >= 1.0.0, < 1.5.0`

## Remediation

Upgrade to a patched release:

- `jupyterhub 1.5.0`