Log in Start free

jupyterhub

Products

ProductCVEsExploitedLatest
jupyterhub7–Oct 11, 2026
oauthenticator5–Apr 3, 2026
jupyter-server-proxy3–Jun 11, 2024
ltiauthenticator2–Apr 3, 2026
kubespawner1–Jul 17, 2020
nbgitpuller1–Aug 25, 2021
binderhub1–Aug 25, 2021
systemdspawner1–Dec 9, 2020
dockerspawner1–Dec 8, 2023
firstuseauthenticator1–Oct 28, 2021
jupyter-remote-desktop-proxy1–Apr 14, 2025

Exploited and recent CVEs

  • CVE-2026-108752 Medium 4.2 JupyterHub through 6.0.1 OAuth Client ID Collision via Unescaped Hyphen 0.2%
  • CVE-2026-54338 Medium 5.3 JupyterHub: Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login 0.4%
  • CVE-2026-40864 Medium 5.4 JupyterHub: Cross-origin form POSTs bypass XSRF 0.1%
  • CVE-2026-34052 Medium 5.9 LTI JupyterHub Authenticator: Unbounded Memory Growth via Nonce Storage (Denial of Service) 0.3%
  • CVE-2026-33709 Medium 5.1 JupyterHub has an Open Redirect Vulnerability 0.2%
  • CVE-2026-33175 High 8.8 OAuthenticator: Authentication Bypass in Auth0OAuthenticator via Unverified Email Claims 0.4%
  • CVE-2025-32428 Critical 9.0 Jupyter Remote Desktop Proxy makes TigerVNC accessible via the network and not just via a UNIX socket as intended 0.9%
  • CVE-2023-25574 Critical 10.0 JupyterHub's LTI13Authenticator: JWT signature not validated 0.4%
  • CVE-2024-41942 High 7.2 JupyterHub has a privilege escalation vulnerability with the `admin:users` scope 0.6%
  • CVE-2024-37300 High 8.1 Globus `identity_provider` restriction ignored when used with `allow_all` in JupyterHub 5.0 0.4%
  • CVE-2024-35225 Critical 9.7 Jupyter Server Proxy has a reflected XSS issue in host parameter 0.4%
  • CVE-2024-28233 High 8.1 XSS in JupyterHub via Self-XSS leveraged by Cookie Tossing 0.3%
  • CVE-2024-29033 High 7.5 GoogleOAuthenticator.hosted_domain incorrectly verifies membership of an Google organization/workspace 0.6%
  • CVE-2024-28179 Critical 9.1 Jupyter Server Proxy's Websocket Proxying does not require authentication 1.0%
  • CVE-2023-48311 High 8.0 Any image allowed by default 0.6%
  • CVE-2022-31027 Medium 4.2 Authorization Bypass Through User-Controlled Key when using CILogonOAuthenticator in oauthenticator 0.5%
  • CVE-2022-21697 Medium 6.3 SSRF vulnerability (requires authentication) 1.1%
  • CVE-2021-41247 Low 3.5 incomplete logout in JupyterHub 0.8%
  • CVE-2021-41194 Critical 9.1 Improper Access Control in jupyterhub-firstuseauthenticator 1.4%
  • CVE-2021-39159 Critical 9.6 Remote code execution in Binderhub 1.9%
  • CVE-2021-39160 Critical 9.6 Code injection in nbgitpuller 1.7%
  • CVE-2020-26261 High 7.9 user-readable api tokens in systemd units 0.5%
  • CVE-2020-26250 Medium 6.3 Base class whitelist configuration ignored in OAuthenticator 1.1%
  • CVE-2020-15110 Medium 6.8 Possible pod name collisions in jupyterhub-kubespawner 1.1%