Read the docs
TI-2026-26088 Aliases CVE-2026-33709GHSA-3vff-hjqv-m7h8

JupyterHub has an Open Redirect Vulnerability

Priority LOW 23CWE-601Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Spoofing
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-601.

Summary

JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks. Prior to version 5.4.4, an open redirect vulnerability in JupyterHub allows attackers to construct links which, when clicked, take users to the JupyterHub login page, after which they are sent to an arbitrary attacker-controlled site outside JupyterHub instead of a JupyterHub page, bypassing JupyterHub's check to prevent this. This issue has been patched in version 5.4.4.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00214 11th percentileScored 2026-11-07
Fix Fixed jupyterhub (jupyterhub): 5.4.4jupyterhub (PyPI): 5.4.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
jupyterhubjupyterhubbefore 5.4.45.4.4Patch availableCNA
—jupyterhub (PyPI)before 5.4.45.4.4Patch availableGHSA-3vff-hjqv-m7h8
  • jupyterhub Vendorjupyterhub Affected before 5.4.4 Fixed in 5.4.4 Patch available CNA
  • jupyterhub (PyPI) Vendor— Affected before 5.4.4 Fixed in 5.4.4 Patch available GHSA-3vff-hjqv-m7h8

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:jupyter:jupyterhub:*:*:*:*:*:*:*:*before 5.4.4Vulnerablejupyterlab
  • cpe:2.3:a:jupyter:jupyterhub:*:*:*:*:*:*:*:* Versions before 5.4.4 Vulnerable ·jupyterlab

Remediation

  • Fix · CNA jupyterhub (jupyterhub) Fixed in 5.4.4
  • Fix · GHSA-3vff-hjqv-m7h8 jupyterhub (PyPI) Fixed in 5.4.4 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33709
  2. 2026-10-03 Alias added: GHSA-3vff-hjqv-m7h8

References

Advisory 2

Other 2

  • TI-2025-23499 Jupyter Remote Desktop Proxy makes TigerVNC accessible via the network and not just via a UNIX socket as intended CVSS 4.0CRITICAL 9.0
  • TI-2023-10877 JupyterHub's LTI13Authenticator: JWT signature not validated CVSS 3.1CRITICAL 10.0
  • TI-2021-16545 Remote code execution in Binderhub CVSS 3.1CRITICAL 9.8
  • TI-2021-18033 Improper Access Control in jupyterhub-firstuseauthenticator CVSS 3.1CRITICAL 9.8
  • TI-2021-16546 Code injection in nbgitpuller CVSS 3.1CRITICAL 9.6
  • TI-2024-18755 Jupyter Server Proxy's Websocket Proxying does not require authentication CVSS 3.1CRITICAL 9.8
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences