Log in Start free

Vulnerability · Published Apr 3, 2026 · Assigned by GitHub_M

CVE-2026-33709JupyterHub has an Open Redirect Vulnerability

Medium 5.1

In plain English

A medium-severity open redirect in jupyterhub from jupyterhub. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)5.1Medium
Exploit odds (30 days)0.2%top 88.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks. Prior to version 5.4.4, an open redirect vulnerability in JupyterHub allows attackers to construct links which, when clicked, take users to the JupyterHub login page, after which they are sent to an arbitrary attacker-controlled site outside JupyterHub instead of a JupyterHub page, bypassing JupyterHub's check to prevent this. This issue has been patched in version 5.4.4.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12jupyterhubno fix listedDEBIAN-CVE-2026-33709
Debian:13jupyterhubno fix listedDEBIAN-CVE-2026-33709
Debian:14jupyterhubno fix listedDEBIAN-CVE-2026-33709
PyPIjupyterhub5.4.4GHSA-3vff-hjqv-m7h8
PyPIjupyterhub5.4.4PYSEC-2026-2188
Ubuntu:22.04:LTSjupyterhubno fix listedUBUNTU-CVE-2026-33709
Ubuntu:24.04:LTSjupyterhubno fix listedUBUNTU-CVE-2026-33709
Ubuntu:25.10jupyterhubno fix listedUBUNTU-CVE-2026-33709
Ubuntu:26.04:LTSjupyterhubno fix listedUBUNTU-CVE-2026-33709
Ubuntu:26.10jupyterhubno fix listedUBUNTU-CVE-2026-33709

Affected products (as reported)

VendorProductVersions
jupyterhub jupyterhub < 5.4.4

Weakness: CWE-601 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References