jupyterhub has 7 CVEs on record between 2021 and 2026. 2 were published in the last 90 days. The median CVSS is 5.4 (medium). None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.4
- Publish → KEV
- —
- Last 90 days
- 2 prev 0
Worst active — by depth score
CVE-2024-28233High· 8.1Cross site scripting (XSS) in JupyterHub via Self-XSS leveraged by Cookie Tossing45CVE-2026-40864Medium· 5.4JupyterHub has cross-origin form POSTs bypass XSRF (CWE-352)42CVE-2024-41942High· 7.2JupyterHub has a privilege escalation vulnerability with the `admin:users` scope40CVE-2026-33709Medium· 6.1JupyterHub has an Open Redirect Vulnerability34CVE-2026-54338Medium· 5.3JupyterHub has Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login29
jupyterhub vulnerabilities
CVEs affecting jupyterhub, newest first. Open any entry for full detail, references, and exploit status.
7 CVEsRSS
CVE-2026-108752Medium· 4.2JupyterHub through 6.0.1 contains an identifier collision vulnerability that allows authenticated users to overwrite another user's named-server OAuth client by registering a hyphenated username
JupyterHub through 6.0.1 contains an identifier collision vulnerability that allows authenticated users to overwrite another user's named-server OAuth client by registering a hyphenated username. Attackers holding a name like alice-prod …
CVE-2026-54338Medium· 5.3JupyterHub has Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login
JupyterHub has Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login
CVE-2026-40864Medium· 5.4PoCJupyterHub has cross-origin form POSTs bypass XSRF (CWE-352)
JupyterHub has cross-origin form POSTs bypass XSRF (CWE-352)
CVE-2026-33709Medium· 6.1JupyterHub has an Open Redirect Vulnerability
JupyterHub has an Open Redirect Vulnerability
CVE-2024-41942High· 7.2JupyterHub has a privilege escalation vulnerability with the `admin:users` scope
JupyterHub has a privilege escalation vulnerability with the `admin:users` scope
CVE-2024-28233High· 8.1Cross site scripting (XSS) in JupyterHub via Self-XSS leveraged by Cookie Tossing
Cross site scripting (XSS) in JupyterHub via Self-XSS leveraged by Cookie Tossing
CVE-2021-41247Low· 3.5incomplete JupyterHub logout with simultaneous JupyterLab sessions
incomplete JupyterHub logout with simultaneous JupyterLab sessions