Jupyter Enterprise Gateway vulnerabilities

Jupyter Enterprise Gateway before version 3.3.0 interpolates untrusted environment variables (e.g., KERNEL_XXX) into Kubernetes manifests without YAML-aware escaping, enabling YAML injection attacks. Attackers can inject new fields, overwrite critical fields (e.g., securityContext), and inject document boundaries (---, ...) to create arbitrary resources, including privileged pods.

Jupyter Enterprise Gateway versions 2.0.0rc2 through 3.3.0 are vulnerable to Server Side Template Injection (SSTI) via KERNEL_XXX environment variables used during Kubernetes manifest rendering. Attackers can execute Python code and OS commands within the Enterprise Gateway service.

Jupyter Enterprise Gateway versions 2.0.0rc1 through 3.3.0 have a vulnerability that bypasses the UID/GID restriction preventing kernel launches as root. A specially crafted KERNEL_UID or KERNEL_GID value allows running kernels as root, increasing the attack surface and potentially leading to container escapes, compromising worker nodes and the entire Kubernetes cluster.