---
id: CVE-2024-28188
aliases:
  - GHSA-v9g2-g7j4-4jxc
  - PYSEC-2026-1479
title: jupyter-scheduler's endpoint is missing authentication
summary: jupyter-scheduler's endpoint is missing authentication
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
vendor: jupyter-scheduler
product: jupyter-scheduler
ecosystem: pip
affected:
  - 'jupyter-scheduler >= 1.0.0, < 1.1.6'
  - 'jupyter-scheduler >= 1.2.0, < 1.2.1'
  - 'jupyter-scheduler >= 1.3.0, < 1.8.2'
  - 'jupyter-scheduler >= 2.0.0, < 2.5.2'
patched:
  - jupyter-scheduler 1.1.6
  - jupyter-scheduler 1.2.1
  - jupyter-scheduler 1.8.2
  - jupyter-scheduler 2.5.2
published: '2024-05-23'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-v9g2-g7j4-4jxc'
references:
  - url: >-
      https://github.com/jupyter-server/jupyter-scheduler/security/advisories/GHSA-v9g2-g7j4-4jxc
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-28188'
  - url: 'https://github.com/jupyter-server/jupyter_server/pull/1392'
  - url: >-
      https://github.com/jupyter-server/jupyter-scheduler/commit/06435a2277bb2b8f441ec9cedafa474572b92c5d
  - url: >-
      https://github.com/jupyter-server/jupyter-scheduler/commit/a621b386397280cc8ee5a208dca4607cb71cdd65
  - url: >-
      https://github.com/jupyter-server/jupyter-scheduler/commit/d428ac871909444e175ba421bf8ab4980d6ebf9f
  - url: >-
      https://github.com/jupyter-server/jupyter-scheduler/commit/f4137a779fdf0cc4a9688a42dd8c6e7ade60f044
  - url: 'https://github.com/jupyter-server/jupyter-scheduler'
tags:
  - osv
  - pip
epss: 0.00331
epssPercentile: 0.23479
ingestedAt: '2026-07-08T18:25:53.286Z'
---

## Overview

### Impact

`jupyter_scheduler` is missing an authentication check in Jupyter Server on an API endpoint (`GET /scheduler/runtime_environments`) which lists the names of the Conda environments on the server. In affected versions, `jupyter_scheduler` allows an unauthenticated user to obtain the list of Conda environment names on the server. This reveals any information that may be present in a Conda environment name.

This issue does **not** allow an unauthenticated third party to read, modify, or enter the Conda environments present on the server where `jupyter_scheduler` is running. This issue only reveals the list of Conda environment names.

Impacted versions: `>=1.0.0,<=1.1.5 ; ==1.2.0 ; >=1.3.0,<=1.8.1 ; >=2.0.0,<=2.5.1`

### Patches

* `jupyter-scheduler==1.1.6`
* `jupyter-scheduler==1.2.1`
* `jupyter-scheduler==1.8.2`
* `jupyter-scheduler==2.5.2`

### Workarounds

Server operators who are unable to upgrade can disable the `jupyter-scheduler` extension with:

```
jupyter server extension disable jupyter-scheduler
```

### References

If you have any questions or comments about this advisory we ask that you contact AWS/Amazon Security via our vulnerability reporting page [1] or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.

[1] Vulnerability reporting page: https://aws.amazon.com/security/vulnerability-reporting


## Affected packages

- `jupyter-scheduler >= 1.0.0, < 1.1.6`
- `jupyter-scheduler >= 1.2.0, < 1.2.1`
- `jupyter-scheduler >= 1.3.0, < 1.8.2`
- `jupyter-scheduler >= 2.0.0, < 2.5.2`

## Remediation

Upgrade to a patched release:

- `jupyter-scheduler 1.1.6`
- `jupyter-scheduler 1.2.1`
- `jupyter-scheduler 1.8.2`
- `jupyter-scheduler 2.5.2`