jupyterhub vulnerabilities
CVEs whose affected-version data names the jupyterhub package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
7 CVEsRSS
CVE-2026-54338Medium· 5.3JupyterHub has Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login
JupyterHub has Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login
▾ Sunlitjupyterhub · jupyterhubEPSS 0.28%via OSV
CVE-2026-40864Medium· 5.4PoCJupyterHub has cross-origin form POSTs bypass XSRF (CWE-352)
JupyterHub has cross-origin form POSTs bypass XSRF (CWE-352)
▾ Twilightjupyterhub · jupyterhubEPSS 0.16%via OSV
CVE-2026-33709Medium· 6.1JupyterHub has an Open Redirect Vulnerability
JupyterHub has an Open Redirect Vulnerability
▾ Sunlitjupyterhub · jupyterhubEPSS 0.21%via OSV
CVE-2024-41942High· 7.2JupyterHub has a privilege escalation vulnerability with the `admin:users` scope
JupyterHub has a privilege escalation vulnerability with the `admin:users` scope
▾ Twilightjupyterhub · jupyterhubEPSS 0.59%via OSV
CVE-2024-28233High· 8.1Cross site scripting (XSS) in JupyterHub via Self-XSS leveraged by Cookie Tossing
Cross site scripting (XSS) in JupyterHub via Self-XSS leveraged by Cookie Tossing
▾ Twilightjupyterhub · jupyterhubEPSS 0.33%via OSV
CVE-2021-41247Low· 3.5incomplete JupyterHub logout with simultaneous JupyterLab sessions
incomplete JupyterHub logout with simultaneous JupyterLab sessions
▾ Sunlitjupyterhub · jupyterhubEPSS 0.80%via OSV
CVE-2019-10255Medium· 6.1Open Redirect vulnerability in jupyterhub and notebook
Open Redirect vulnerability in jupyterhub and notebook
▾ Sunlitnotebook · notebookEPSS 2.1%via OSV