CVE-2020-26261: jupyterhub systemdspawner Exposure of Resource to Wrong Sphere
Vulnerability summary
CVE-2020-26261 is a high (CVSS 7.9) Exposure of Resource to Wrong Sphere vulnerability in jupyterhub systemdspawner. EPSS estimates a 0.48% chance of exploitation in the next 30 days, higher than 40.1% of scored vulnerabilities.
Timeline
- 09-12-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
jupyterhub-systemdspawner enables JupyterHub to spawn single-user notebook servers using systemd. In jupyterhub-systemdspawner before version 0.15 user API tokens issued to single-user servers are specified in the environment of systemd units. These tokens are incorrectly accessible to all users. In particular, the-littlest-jupyterhub is affected, which uses systemdspawner by default. This is patched in jupyterhub-systemdspawner v0.15
CVSS metrics
5 scores · 3 sources · 3 versions- OSV · PypiEcosystem advisory · calculated7.9HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
- NVDNIST7.9HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
EPSS trend
Probability
0.48%
Chance of exploitation in the next 30 days
Percentile
40%
Versus all other CVEs
30-day change
0.00 pp
From 0.48% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Jupyterhub1 product
- systemdspawner< 0.15
PyPI1 product
- jupyterhub-systemdspawner< a4d08fd2ade1cfd0ef2c29dc221e649345f23580 | < 0.15.0
2 vendors · 2 products
References
8 links- github.com/jupyterhub/systemdspawner/security/advisories/GHSA-cg54-gpgr-4rm6X Refsource CONFIRMWEBAdvisoryThird Party Advisory
- github.com/jupyterhub/systemdspawner/commit/a4d08fd2ade1cfd0ef2c29dc221e649345f23580X Refsource MISCWEBFIXPatchThird Party Advisory
- github.com/jupyterhub/systemdspawner/blob/master/CHANGELOG.mdX Refsource MISCWEBRelease NotesThird Party Advisory
