Read the docs
TI-2024-18764 Aliases CVE-2024-28188GHSA-v9g2-g7j4-4jxc

jupyter-scheduler's endpoint is missing authentication

Priority LOW 30CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure, Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200 and CWE-287.

Summary

Jupyter Scheduler is collection of extensions for programming jobs to run now or run on a schedule. The list of conda environments of `jupyter-scheduler` users maybe be exposed, potentially revealing information about projects that a specific user may be working on. This vulnerability has been patched in version(s) 1.1.6, 1.2.1, 1.8.2 and 2.5.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00331 26th percentileScored 2026-11-07
Fix Fixed jupyter-scheduler (PyPI): 1.1.6, 1.2.1, 1.8.2 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
jupyterlabjupyter-scheduler1.0.0 – 1.1.5; = 1.2.0; 1.3.0 – 1.8.1; 2.0.0 – 2.5.1—No fix listedCNA
—jupyter-scheduler (PyPI)1.0.0 to before 1.1.61.1.6Patch availableGHSA-v9g2-g7j4-4jxc
—jupyter-scheduler (PyPI)1.2.0 to before 1.2.11.2.1Patch availableGHSA-v9g2-g7j4-4jxc
—jupyter-scheduler (PyPI)1.3.0 to before 1.8.21.8.2Patch availableGHSA-v9g2-g7j4-4jxc
—jupyter-scheduler (PyPI)2.0.0 to before 2.5.22.5.2Patch availableGHSA-v9g2-g7j4-4jxc
  • jupyter-scheduler Vendorjupyterlab Affected 1.0.0 – 1.1.5; = 1.2.0; 1.3.0 – 1.8.1; 2.0.0 – 2.5.1 Fixed in — No fix listed CNA
  • jupyter-scheduler (PyPI) Vendor— Affected 1.0.0 to before 1.1.6 Fixed in 1.1.6 Patch available GHSA-v9g2-g7j4-4jxc
  • jupyter-scheduler (PyPI) Vendor— Affected 1.2.0 to before 1.2.1 Fixed in 1.2.1 Patch available GHSA-v9g2-g7j4-4jxc
  • jupyter-scheduler (PyPI) Vendor— Affected 1.3.0 to before 1.8.2 Fixed in 1.8.2 Patch available GHSA-v9g2-g7j4-4jxc
  • jupyter-scheduler (PyPI) Vendor— Affected 2.0.0 to before 2.5.2 Fixed in 2.5.2 Patch available GHSA-v9g2-g7j4-4jxc

CPE names CISA-ADP · 1

CPEVersionsRoleVendor
cpe:2.3:a:jupyter:scheduler:1.0.0:*:*:*:*:*:*:*1.0.0—jupyterlab
  • cpe:2.3:a:jupyter:scheduler:1.0.0:*:*:*:*:*:*:* Versions 1.0.0 — ·jupyterlab

Remediation

  • Fix · GHSA-v9g2-g7j4-4jxc jupyter-scheduler (PyPI) Fixed in 1.1.6 Advisory →
  • Fix · GHSA-v9g2-g7j4-4jxc jupyter-scheduler (PyPI) Fixed in 1.2.1 Advisory →
  • Fix · GHSA-v9g2-g7j4-4jxc jupyter-scheduler (PyPI) Fixed in 1.8.2 Advisory →
  • Fix · GHSA-v9g2-g7j4-4jxc jupyter-scheduler (PyPI) Fixed in 2.5.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-28188
  2. 2026-10-03 Alias added: GHSA-v9g2-g7j4-4jxc

References

Advisory 1

Other 7

  • TI-2026-32161 Jupyter Enterprise Gateway Has Kubernetes Manifest Injection via Jinja2 Template Rendering CVSS 4.0CRITICAL 10.0
  • TI-2026-32160 Jupyter Enterprise Gateway: Jinja2 Template Server Side Template Injection results in Remote Code Execution CVSS 4.0CRITICAL 10.0
  • TI-2026-32159 Jupyter Enterprise Gateway: ContainerProcessProxy._enforce_prohibited_ids can be Bypassed CVSS 3.1CRITICAL 9.8
  • TI-2024-26623 Remote Code Execution (RCE) vulnerability in jupyterlab extension template `update-integration-tests` GitHub Action CVSS 3.1CRITICAL 10.0
  • TI-2026-78983 Path traversal in nbconvert lets crafted notebooks write files CVSS 4.0HIGH 8.8
  • TI-2026-39372 JupyterLab Git: Stored XSS leading to RCE CVSS 4.0CRITICAL 9.3
See all 89 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences