Skip to content
OpenAdvisories

Vendor

jupyterhub

24 known vulnerabilities.

Products

jupyterhub 7 oauthenticator 5 jupyter-server-proxy 3 ltiauthenticator 2 dockerspawner 1 systemdspawner 1 binderhub 1 jupyter-remote-desktop-proxy 1 firstuseauthenticator 1 kubespawner 1 nbgitpuller 1
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 8.8
    CVE-2026-33175

    OAuthenticator: Authentication Bypass in Auth0OAuthenticator via Unverified Email Claims

    OAuthenticator is software that allows OAuth2 identity providers to be plugged in and used with JupyterHub. Prior to version 17.4.0, an authentication bypass vulnerability in oauthenticator allows an attacker with an unverified email address on an Auth0 tenan…

    jupyterhub oauthenticator oauthenticator py3.11-oauthenticator Wolfi PyPI
  • High 7.2
    CVE-2024-41942

    JupyterHub has a privilege escalation vulnerability with the `admin:users` scope

    JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks. Prior to versions 4.1.6 and 5.1.0, if a user is granted the `admin:users` scope, they may escalate their own privileges by making themselves a full admin user. The imp…

    jupyterhub jupyterhub jupyterhub jupyterhub Debian Ubuntu Wolfi PyPI
  • High 8.1
    CVE-2024-37300

    Globus `identity_provider` restriction ignored when used with `allow_all` in JupyterHub 5.0

    OAuthenticator is software that allows OAuth2 identity providers to be plugged in and used with JupyterHub. JupyterHub < 5.0, when used with `GlobusOAuthenticator`, could be configured to allow all users from a particular institution only. This worked fine pr…

    jupyterhub oauthenticator oauthenticator py3-oauthenticator Wolfi PyPI
  • High 8.1
    CVE-2024-28233

    XSS in JupyterHub via Self-XSS leveraged by Cookie Tossing

    JupyterHub is an open source multi-user server for Jupyter notebooks. By tricking a user into visiting a malicious subdomain, the attacker can achieve an XSS directly affecting the former's session. More precisely, in the context of JupyterHub, this XSS could…

    jupyterhub jupyterhub jupyterhub jupyterhub Debian Ubuntu PyPI
  • High 7.5
    CVE-2024-29033

    GoogleOAuthenticator.hosted_domain incorrectly verifies membership of an Google organization/workspace

    OAuthenticator provides plugins for JupyterHub to use common OAuth providers, as well as base classes for writing one's own Authenticators with any OAuth 2.0 provider. `GoogleOAuthenticator.hosted_domain` is used to restrict what Google accounts can be author…

    jupyterhub oauthenticator oauthenticator py3-oauthenticator Wolfi PyPI
  • High 8.0
    CVE-2023-48311

    Any image allowed by default

    dockerspawner is a tool to spawn JupyterHub single user servers in Docker containers. Users of JupyterHub deployments running DockerSpawner starting with 0.11.0 without specifying `DockerSpawner.allowed_images` configuration allow users to launch _any_ pullab…

    jupyterhub dockerspawner dockerspawner PyPI
  • High 7.9
    CVE-2020-26261

    user-readable api tokens in systemd units

    jupyterhub-systemdspawner enables JupyterHub to spawn single-user notebook servers using systemd. In jupyterhub-systemdspawner before version 0.15 user API tokens issued to single-user servers are specified in the environment of systemd units. These tokens ar…

    jupyterhub systemdspawner jupyterhub-systemdspawner PyPI