TI-2021-18082 Aliases CVE-2021-41247 GHSA-cw7p-q79f-m2v7

incomplete logout in JupyterHub

LOW 34CWE-613Published 2021-11-04 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: None · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-613.

Summary

JupyterHub is an open source multi-user server for Jupyter notebooks. In affected versions users who have multiple JupyterLab tabs open in the same browser session, may see incomplete logout from the single-user server, as fresh credentials (for the single-user server only, not the Hub) reinstated after logout, if another active JupyterLab session is open while the logout takes place. Upgrade to JupyterHub 1.5. For distributed deployments, it is jupyterhub in the _user_ environment that needs patching. There are no patches necessary in the Hub environment. The only workaround is to make sure that only one JupyterLab tab is open when you log out.

Why it matters now

EPSS 0.00804 56th percentileScored 2026-11-07

Fix Fixed jupyterhub (PyPI): 1.5.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
jupyterhub	jupyterhub	>= 1.0.0, < 1.5.0 - jupyterhub (pip); < 1.2.0 - jupyterhub (helm)	—	No fix listed	CNA
—	jupyterhub (PyPI)	1.0.0 to before 1.5.0	1.5.0	Patch available	GHSA-cw7p-q79f-m2v7

jupyterhub Vendorjupyterhub Affected >= 1.0.0, < 1.5.0 - jupyterhub (pip); < 1.2.0 - jupyterhub (helm) Fixed in — No fix listed CNA
jupyterhub (PyPI) Vendor— Affected 1.0.0 to before 1.5.0 Fixed in 1.5.0 Patch available GHSA-cw7p-q79f-m2v7

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:jupyter:jupyterhub::::::::	1.0.0 to before 1.5.0	Vulnerable	jupyterlab

cpe:2.3:a:jupyter:jupyterhub:*:*:*:*:*:*:*:* Versions 1.0.0 to before 1.5.0 Vulnerable ·jupyterlab

Remediation

Fix · GHSA-cw7p-q79f-m2v7 jupyterhub (PyPI) Fixed in 1.5.0 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2021-41247
2026-10-03 Alias added: GHSA-cw7p-q79f-m2v7

References

Patch 1

https://github.com/jupyterhub/jupyterhub/commit/5ac9e7f73a6e1020ffddc40321fc53336829fe27

Advisory 2

Other 2

TI-2025-23499 Jupyter Remote Desktop Proxy makes TigerVNC accessible via the network and not just via a UNIX socket as intended CVSS 4.0CRITICAL 9.0
TI-2023-10877 JupyterHub's LTI13Authenticator: JWT signature not validated CVSS 3.1CRITICAL 10.0
TI-2021-16545 Remote code execution in Binderhub CVSS 3.1CRITICAL 9.8
TI-2021-18033 Improper Access Control in jupyterhub-firstuseauthenticator CVSS 3.1CRITICAL 9.8
TI-2021-16546 Code injection in nbgitpuller CVSS 3.1CRITICAL 9.6
TI-2024-18755 Jupyter Server Proxy's Websocket Proxying does not require authentication CVSS 3.1CRITICAL 9.8

See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences