CVE-2026-54338
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
JupyterHub before version 5.5.0 has a vulnerability where invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and storage resources.
Risk Assessment
The risk includes potential exhaustion of disk and log resources, leading to performance degradation and hindering monitoring.
Recommendation
Upgrade to version 5.5.0 or later. Monitor log sizes and restrict access to login.
Other vulnerabilities in JupyterHub
See all- CVE-2026-108752Medium
JupyterHub through 6.0.1 contains an identifier collision vulnerability that allows authenticated users to overwrite another user's named-server OAuth client by registering a hyphenated username. Attackers holding a name like alice-prod can overwrite the client for alice's server prod, breaking OAuth login and revoking tokens by stopping their own server.
- CVE-2026-40864Medium
JupyterHub versions 4.1.0 through 5.4.4 inappropriately treated requests with Sec-Fetch-Mode: no-cors as same-origin requests, bypassing XSRF checks. This affects only HTTP form endpoints, allowing attackers to trigger server spawn and, if the attacker is a JupyterHub user with share permissions, force a user to accept a share and gain access to the attacker's server.
- CVE-2026-33709Medium
JupyterHub before version 5.4.4 has an open redirect vulnerability that allows attackers to construct links which, when clicked, take users to the JupyterHub login page, after which they are sent to an arbitrary attacker-controlled site, bypassing JupyterHub's check to prevent this.
Original NVD description (English source)
JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and storage resources. This issue is fixed in version 5.5.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS