Medium severity · published Apr 3, 2026
CVE-2026-33709
JupyterHub has an Open Redirect Vulnerability
6.1
CVSS
0.2%
EPSS
No
On KEV
Description
JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks. Prior to version 5.4.4, an open redirect vulnerability in JupyterHub allows attackers to construct links which, when clicked, take users to the JupyterHub login page, after which they are sent to an arbitrary attacker-controlled site outside JupyterHub instead of a JupyterHub page, bypassing JupyterHub's check to prevent this. This issue has been patched in version 5.4.4.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JU
jupyterhub · jupyterhub
< 5.4.4 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-33709
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-33709
Product
https://github.com/jupyterhub/jupyterhub/releases/tag/5.4.4
Mitigation
https://github.com/jupyterhub/jupyterhub/security/advisories/GHSA-3vff-hjqv-m7h8
More from jupyterhub
5.3
CVE-2026-54338
JupyterHub: Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login
4.3
CVE-2026-40864
JupyterHub: Cross-origin form POSTs bypass XSRF
4.2
CVE-2026-108752
JupyterHub through 6.0.1 OAuth Client ID Collision via Unescaped Hyphen