JupyterHub: Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login
Priority LOW 30CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.
Summary
JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and storage resources. This issue is fixed in version 5.5.0.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00437 38th percentileScored 2026-11-07
Fix Fixed jupyterhub (PyPI): 5.5.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| jupyterhub | jupyterhub | < 5.5.0JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and storage resources. This issue is fixed in version 5.5.0. | — | No fix listed | CNA |
| — | jupyterhub (PyPI) | before 5.5.0 | 5.5.0 | Patch available | GHSA-p43p-whwx-q52h |
- jupyterhub Vendorjupyterhub Affected < 5.5.0JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and storage resources. This issue is fixed in version 5.5.0. Fixed in — No fix listed CNA
- jupyterhub (PyPI) Vendor— Affected before 5.5.0 Fixed in 5.5.0 Patch available GHSA-p43p-whwx-q52h
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:jupyter:jupyterhub:*:*:*:*:*:*:*:* | — | — | jupyterlab |
- cpe:2.3:a:jupyter:jupyterhub:*:*:*:*:*:*:*:* Versions — — ·jupyterlab
Remediation
- Fix · GHSA-p43p-whwx-q52h jupyterhub (PyPI) Fixed in 5.5.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-54338
- 2026-10-03 Alias added: GHSA-p43p-whwx-q52h
References
More jupyterhub vulnerabilities
- TI-2025-23499 Jupyter Remote Desktop Proxy makes TigerVNC accessible via the network and not just via a UNIX socket as intended CVSS 4.0CRITICAL 9.0
- TI-2023-10877 JupyterHub's LTI13Authenticator: JWT signature not validated CVSS 3.1CRITICAL 10.0
- TI-2021-16545 Remote code execution in Binderhub CVSS 3.1CRITICAL 9.8
- TI-2021-18033 Improper Access Control in jupyterhub-firstuseauthenticator CVSS 3.1CRITICAL 9.8
- TI-2021-16546 Code injection in nbgitpuller CVSS 3.1CRITICAL 9.6
- TI-2024-18755 Jupyter Server Proxy's Websocket Proxying does not require authentication CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-54338 · CVE Program
- CVE-2026-54338 · NVD
- FIRST EPSS
- GHSA-p43p-whwx-q52h · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences