CVE-2026-33709 jupyterhub CVE debrief

Who should care

Users of JupyterHub, especially those hosting multi-user servers for Jupyter notebooks, should be aware of this vulnerability and ensure they are running version 5.4.4 or later to prevent potential attacks. This vulnerability affects multi-user servers for Jupyter notebooks and allows attackers to construct links which, when clicked, take users to the JupyterHub login page and then send them to an arbitrary attacker-controlled site outside JupyterHub.

Technical summary

The open redirect vulnerability in JupyterHub allows attackers to construct malicious links. When these links are clicked, users are taken to the JupyterHub login page and then redirected to an attacker-controlled site. This bypasses JupyterHub's checks to prevent such redirects. The vulnerability has been patched in JupyterHub version 5.4.4. Users should ensure they are running version 5.4.4 or later to prevent potential attacks. This vulnerability affects multi-user servers for Jupyter notebooks.

Defensive priority

Medium priority should be given to updating JupyterHub to version 5.4.4 or later to mitigate this vulnerability. Defenders should review the official CVE record and NVD entry for further details.

Recommended defensive actions

• Update JupyterHub to version 5.4.4 or later
• Review and monitor user access and authentication logs for suspicious activity
• Educate users about the risks of clicking on suspicious links
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-04-03T22:16:26.657Z and last modified on 2026-07-24T22:10:00.140Z. The NVD entry is currently Analyzed. This information is based on the provided source corpus and has not been independently verified. Defenders should review the official CVE record and NVD entry for further details. The open redirect vulnerability in JupyterHub allows attackers to construct links which, when clicked, take users to the JupyterHub login page and then send them to an arbitrary attacker-controlled site outside JupyterHub. This issue has been patched in version 5.4.4.

Official resources