In short
- CVE-2026-54338 is a MEDIUM (CVSS 5.3) vulnerability affecting jupyterhub.
- Chance of exploitation in the next 30 days (EPSS): 0.44%, higher than 38.0% of all vulnerabilities.
- Fix: update to 5.5.0 or later.
| Package | Affected versions | Patched versions |
|---|
| jupyterhub PyPI | < 5.5.0
| 5.5.0
|
Description
Impact
Invalid input to login resulted in unbounded logging output. Only form-based Authenticators (the default PAM Authenticator, but not the more widely used OAuthenticator) are affected.
Patches
Upgrade to 5.5.0.
Workarounds
Use an Authenticator that doesn't use a login form, such as OAuthenticator.
NVD description
JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and storage resources. This issue is fixed in version 5.5.0.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free