PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-33709 jupyterhub CVE debrief

CVE-2026-33709 is an open redirect vulnerability in JupyterHub, a software allowing one to create a multi-user server for Jupyter notebooks. Prior to version 5.4.4, attackers can construct links which, when clicked, take users to the JupyterHub login page and then send them to an arbitrary attacker-controlled site outside JupyterHub. This issue has been patched in version 5.4.4. Users of JupyterHub, especially those hosting multi-user servers for Jupyter notebooks, should be aware of this vulnerability and ensure they are running version 5.4.4 or later to prevent potential attacks. The vulnerability allows attackers to bypass JupyterHub's checks to prevent redirects.

Vendor
jupyterhub
Product
Unknown
CVSS
MEDIUM 5.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-03
Original CVE updated
2026-07-24
Advisory published
2026-04-03
Advisory updated
2026-07-24

Who should care

Users of JupyterHub, especially those hosting multi-user servers for Jupyter notebooks, should be aware of this vulnerability and ensure they are running version 5.4.4 or later to prevent potential attacks. This vulnerability affects multi-user servers for Jupyter notebooks and allows attackers to construct links which, when clicked, take users to the JupyterHub login page and then send them to an arbitrary attacker-controlled site outside JupyterHub.

Technical summary

The open redirect vulnerability in JupyterHub allows attackers to construct malicious links. When these links are clicked, users are taken to the JupyterHub login page and then redirected to an attacker-controlled site. This bypasses JupyterHub's checks to prevent such redirects. The vulnerability has been patched in JupyterHub version 5.4.4. Users should ensure they are running version 5.4.4 or later to prevent potential attacks. This vulnerability affects multi-user servers for Jupyter notebooks.

Defensive priority

Medium priority should be given to updating JupyterHub to version 5.4.4 or later to mitigate this vulnerability. Defenders should review the official CVE record and NVD entry for further details.

Recommended defensive actions

  • Update JupyterHub to version 5.4.4 or later
  • Review and monitor user access and authentication logs for suspicious activity
  • Educate users about the risks of clicking on suspicious links
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-04-03T22:16:26.657Z and last modified on 2026-07-24T22:10:00.140Z. The NVD entry is currently Analyzed. This information is based on the provided source corpus and has not been independently verified. Defenders should review the official CVE record and NVD entry for further details. The open redirect vulnerability in JupyterHub allows attackers to construct links which, when clicked, take users to the JupyterHub login page and then send them to an arbitrary attacker-controlled site outside JupyterHub. This issue has been patched in version 5.4.4.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-33709 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-33709

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-33709 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-33709

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.