JupyterGHSA-cw7p-q79f-m2v7
incomplete JupyterHub logout with simultaneous JupyterLab sessions
Medium3.5CVE-2021-41247 · Published Nov 8, 2021 · updated Jul 8, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| jupyterhub PyPI | >= 1.0.0, < 1.5.0 | 1.5.0 |
Details and references
### Impact Users of JupyterLab with JupyterHub who have multiple JupyterLab tabs open in the same browser session, may see incomplete logout from the single-user server, as fresh credentials (for the single-user server only, not the Hub) reinstated after logout, if another active JupyterLab session is open while the logout takes place. ### Patches Upgrade to JupyterHub 1.5. For distributed deployments, it is jupyterhub in the _user_ environment that needs patching. There are no patches necessary in the Hub environment. ### Workarounds The only workaround is to make sure that only one JupyterLab tab is open when you log out.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-613
- Also known as
- BIT-jupyterhub-2021-41247, CVE-2021-41247, PYSEC-2021-386
- github.com/jupyterhub/jupyterhub/security/advisories/GHSA-cw7p-q79f-m2v7
- nvd.nist.gov/vuln/detail/CVE-2021-41247
- github.com/jupyterhub/jupyterhub/commit/5ac9e7f73a6e1020ffddc40321fc53336829fe27
- github.com/jupyterhub/jupyterhub
- github.com/pypa/advisory-database/tree/main/vulns/jupyterhub/PYSEC-2021-386.yaml
More Jupyter advisories
All Jupyter| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Aug 232021 | Special Element Injection in notebook CVE-2021-32798High10.0fixed in 5.7.11, 6.4.1 | High10.0 | 5.7.11, 6.4.1 |
| Aug 232021 | JupyterLab: XSS due to lack of sanitization of the action attribute of an html <form> CVE-2021-32797Medium7.4fixed in 1.2.21, 2.2.10, 2.3.2, 3.0.17 | Medium7.4 | 1.2.21, 2.2.10, 2.3.2, 3.0.17 |
| Mar 252022 | Insertion of Sensitive Information into Log File in Jupyter notebook CVE-2022-24757High7.5fixed in 1.15.4 | High7.5 | 1.15.4 |
| Apr 52022 | Sensitive Auth & Cookie data stored in Jupyter server logs CVE-2022-24758High7.5fixed in 6.4.10 | High7.5 | 6.4.10 |
| May 142022 | Improper Neutralization of Input During Web Page Generation in Jupyter Notebook CVE-2019-9644Medium5.4fixed in 5.7.6 | Medium5.4 | 5.7.6 |
| May 142022 | Improper Neutralization of Input During Web Page Generation in Jupyter Notebook CVE-2015-6938Medium6.1fixed in 4.0.5 | Medium6.1 | 4.0.5 |