CVE-2026-23528: Dask distributed Vulnerable to Remote Code Execution via Jupyter Proxy and Dashboard
Vulnerability summary
CVE-2026-23528 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in anaconda dask. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 13.6% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 0 · Related 3Timeline
- 16-01-2026PublishedVulnerability first disclosed.
- 16-01-2026Last modifiedVulnerability information updated.
Description
Dask distributed is a distributed task scheduler for Dask. Prior to 2026.1.0, when Jupyter Lab, jupyter-server-proxy, and Dask distributed are all run together, it is possible to craft a URL which will result in code being executed by Jupyter due to a cross-side-scripting (XSS) bug in the Dask dashboard. It is possible for attackers to craft a phishing URL that assumes Jupyter Lab and Dask may be running on localhost and using default ports. If a user clicks on the malicious link it will open an error page in the Dask Dashboard via the Jupyter Lab proxy which will cause code to be executed by the default Jupyter Python kernel. This vulnerability is fixed in 2026.1.0.
CVSS metrics
9 scores · 7 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
- OSV · WolfiEcosystem advisory · calculated5.3MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
- OSV · ChainguardEcosystem advisory · calculated5.3MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
- NVDNIST5.3MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · PypiEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · UbuntuEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · DebianEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS trend
Probability
0.24%
Chance of exploitation in the next 30 days
Percentile
14%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.24% on 23-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
- CWE-80Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
- CWE-250Execution with Unnecessary PrivilegesThe product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.
Affected systems
Chainguard2 products
- dask-gateway< 2025.4.0-r7
- dask-kubernetes< 2025.7.0-r6
Wolfi2 products
- dask-gateway< 2025.4.0-r7
- dask-kubernetes< 2025.7.0-r6
Anaconda1 product
- dask< 2026.1.0
Dask1 product
- distributed< 2026.1.0
Debian1 product
- dask.distributedAll versions (No fix recorded) | < 2024.12.1+ds-3
PyPI1 product
- distributed< 2026.1.0
Ubuntu1 product
- dask.distributedAll versions (No fix recorded)
7 vendors · 9 products
References
9 links- github.com/dask/distributed/security/advisories/GHSA-c336-7962-wfj2X Refsource CONFIRMWEBAdvisoryREPORTVendor Advisory
- github.com/dask/distributed/commit/ab72092a8a938923c2bb51a2cd14ca26614827faX Refsource MISCWEBFIXREPORTPatch
- github.com/dask/distributedPACKAGE
