Vulnerability · Published May 23, 2024 · Assigned by GitHub_M
CVE-2024-28188jupyter-scheduler's endpoint is missing authentication
Medium 5.3
In plain English
A medium-severity information exposure in jupyter-scheduler from jupyter-server. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Jupyter Scheduler is collection of extensions for programming jobs to run now or run on a schedule. The list of conda environments of `jupyter-scheduler` users maybe be exposed, potentially revealing information about projects that a specific user may be working on. This vulnerability has been patched in version(s) 1.1.6, 1.2.1, 1.8.2 and 2.5.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | jupyter-scheduler | 1.1.6 | GHSA-v9g2-g7j4-4jxc |
| PyPI | jupyter-scheduler | 1.2.1 | GHSA-v9g2-g7j4-4jxc |
| PyPI | jupyter-scheduler | 1.8.2 | GHSA-v9g2-g7j4-4jxc |
| PyPI | jupyter-scheduler | 2.5.2 | GHSA-v9g2-g7j4-4jxc |
| PyPI | jupyter-scheduler | 1.1.6, 1.2.1, 1.8.2, 2.5.2 | PYSEC-2026-1479 |
| Ubuntu:22.04:LTS | jupyter-server | no fix listed | UBUNTU-CVE-2024-28188 |
| Ubuntu:24.04:LTS | jupyter-server | no fix listed | UBUNTU-CVE-2024-28188 |
| Ubuntu:25.10 | jupyter-server | no fix listed | UBUNTU-CVE-2024-28188 |
| Ubuntu:26.04:LTS | jupyter-server | no fix listed | UBUNTU-CVE-2024-28188 |
| Ubuntu:26.10 | jupyter-server | no fix listed | UBUNTU-CVE-2024-28188 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| jupyter-server | jupyter-scheduler | >= 1.0.0, <= 1.1.5= 1.2.0>= 1.3.0, <= 1.8.1>= 2.0.0, <= 2.5.1 |
Weakness: CWE-200, CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N