Jupyterhub CVE-2026-33709

This vulnerability presents moderate real-world risk. The CVSS score of 5.1 reflects low impact (confidentiality and integrity each scored as low), but the attack vector is network-based with low complexity and no authentication requirement. The presence of user interaction (UI:A) significantly reduces exploitability compared to fully automated attacks, placing it below critical severity thresholds. However, the practical attack scenario-phishing via a trusted JupyterHub domain-is credible and dangerous in educational and research environments where JupyterHub is commonly deployed. The lack of EPSS, KEV, or public POC data indicates this has not been demonstrated as actively exploited in the wild at scale, suggesting it remains primarily a patching priority rather than an emergency incident response scenario. Organizations should prioritize upgrading after patch release, particularly for public-facing JupyterHub instances.

An attacker crafts a malicious link such as 'https://legitimate-jupyterhub.edu/hub/login?next=https://attacker.com/phishing' and distributes it via email to JupyterHub users, perhaps claiming it points to a course login page. When clicked, users see the legitimate JupyterHub login interface, enter their credentials, and are then redirected to an attacker-controlled phishing site that mimics JupyterHub's interface to harvest additional credentials or session tokens. The vulnerability bypasses JupyterHub's existing redirect check, making the attack appear seamlessly legitimate to users. No public exploit code has been identified, and the attack requires user interaction to succeed.