Advisoriesby IbisJupyterGHSA-3vff-hjqv-m7h8
JupyterHub has an Open Redirect Vulnerability
Fix: upgrade to 5.4.4 or later
Affected Version
JupyterHub <= 5.4.3
Impact
An open redirect vulnerability in JupyterHub <=5.4.3 allows attackers to construct links which, when clicked, take users to the JupyterHub login page, after which they are sent to an arbitrary attacker-controlled site outside JupyterHub instead of a JupyterHub page, bypassing JupyterHub's check to prevent this.
Patches
Upgrade to JupyterHub 5.4.4
Workarounds
A deployment can apply filters on the Location header in a reverse proxy such as nginx/apache/traefik.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| jupyterhub PyPI | < 5.4.4 | 5.4.4 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-601
- Also known as
- BIT-jupyterhub-2026-33709, CVE-2026-33709, PYSEC-2026-2188
More Jupyter advisories
All Jupyter
Jupyter Server has a CORS Origin Validation Bypass via `re.match()` in `allow_origin_pat`CVE-2026-40110fixed in 2.18.0Jupyter: path traversalCVE-2026-35397fixed in 2.18.0Jupyter Server has an open redirection vulnerability in `next` query parameterCVE-2025-61669fixed in 2.18.0Jupyter Notebook Vulnerable to Authentication Token Theft via CommandLinker XSSCVE-2026-40171fixed in 4.5.7 +1nbconvert has an Arbitrary File Read via Path Traversal in HTMLExporter Image EmbeddingCVE-2026-39378fixed in 7.17.1nbconvert has an Arbitrary File Write via Path Traversal in Cell Attachment FilenamesCVE-2026-39377fixed in 7.17.1