JupyterHub CVE-2026-54338

No authentication is required - the vulnerability is triggered by submitting a POST request to the publicly accessible /login endpoint with an arbitrarily long 'username' field value. The only prerequisite is network reachability to the JupyterHub login page and that the instance uses form-based login (the default configuration). Exploitation is limited by: the host's available disk I/O bandwidth (caps write rate), any upstream rate limiting or WAF rules on POST body size or request frequency, and the size of the log partition relative to available attack throughput. Deployments using token-only or OAuth-only authentication with form-based login disabled are not affected by this specific path, but the PAM authenticator path in auth.py represents a separate affected code location for PAM-enabled deployments.

The CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) accurately reflects a remotely exploitable, low-complexity, unauthenticated issue with limited availability impact - no confidentiality or integrity loss is possible. The practical risk is disk exhaustion on the JupyterHub host: an attacker submitting sustained login requests with multi-megabyte usernames can fill log partitions, potentially disrupting the host's ability to write system logs or other application data. However, the impact is bounded by available disk I/O rate and any upstream rate limiting. This is not listed in CISA KEV and no POC has been publicly disclosed, indicating no confirmed active exploitation. EPSS data was not provided in input. The real-world priority is moderate for internet-exposed JupyterHub deployments with no ingress rate limiting; low for deployments behind authentication proxies or network-restricted environments. No conflicting signals exist between CVSS vector and description.

An unauthenticated attacker sends a high-frequency stream of HTTP POST requests to the JupyterHub /login endpoint, each containing a username field populated with several megabytes of arbitrary data. Each failed authentication attempt writes the full oversized username to the application log, rapidly filling the host's log partition. If the log volume shares disk space with the OS or JupyterHub's working directory, the resulting exhaustion can prevent new user sessions, corrupt in-flight notebook saves, or crash dependent services. No POC code has been publicly identified.