CVE-2026-54338
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
JupyterHub before version 5.5.0 has a vulnerability where invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and storage resources.
Risk Assessment
The risk includes potential exhaustion of disk and log resources, leading to performance degradation and hindering monitoring.
Recommendation
Upgrade to version 5.5.0 or later. Monitor log sizes and restrict access to login.
Original NVD description (English source)
JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and storage resources. This issue is fixed in version 5.5.0.