JupyterGHSA-3vff-hjqv-m7h8
JupyterHub has an Open Redirect Vulnerability
Medium6.1CVE-2026-33709 · Published Apr 3, 2026 · updated Jul 13, 2026
## Affected Version JupyterHub <= 5.4.3 ## Impact An open redirect vulnerability in JupyterHub <=5.4.3 allows attackers to construct links which, when clicked, take users to the JupyterHub login page, after which they are sent to an arbitrary attacker-controlled site outside JupyterHub instead of a JupyterHub page, bypassing JupyterHub's check to prevent this. ## Patches Upgrade to JupyterHub 5.4.4 ## Workarounds A deployment can apply filters on the Location header in a reverse proxy such as nginx/apache/traefik.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| jupyterhub PyPI | < 5.4.4 | 5.4.4 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-601
- Also known as
- BIT-jupyterhub-2026-33709, CVE-2026-33709, PYSEC-2026-2188
More Jupyter advisories
All Jupyter| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| May 5 | Jupyter Server has a CORS Origin Validation Bypass via `re.match()` in `allow_origin_pat` HighMay 5 | High | 2.18.0 |
| May 5 | Jupyter: path traversalHigh7.1May 5 | High7.1 | 2.18.0 |
| May 5 | Jupyter Server has an open redirection vulnerability in `next` query parameterMediumMay 5 | Medium | 2.18.0 |
| Apr 30 | Jupyter Notebook Vulnerable to Authentication Token Theft via CommandLinker XSSHighApr 30 | High | 4.5.7+1 more |
| Apr 21 | nbconvert has an Arbitrary File Read via Path Traversal in HTMLExporter Image EmbeddingMedium6.5Apr 21 | Medium6.5 | 7.17.1 |
| Apr 21 | nbconvert has an Arbitrary File Write via Path Traversal in Cell Attachment FilenamesMedium6.5Apr 21 | Medium6.5 | 7.17.1 |