CVE-2021-41247 incomplete logout in JupyterHub
Attackers can retain access to single-user servers after logout if multiple tabs are open, bypassing session termination controls.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-41247?
CVE-2021-41247 is a low-severity vulnerability in jupyterhub, published on 4 Nov 2021. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
JupyterHub is an open source multi-user server for Jupyter notebooks. In affected versions users who have multiple JupyterLab tabs open in the same browser session, may see incomplete logout from the single-user server, as fresh credentials (for the single-user server only, not the Hub) reinstated after logout, if another active JupyterLab session is open while the logout takes place. Upgrade to JupyterHub 1.5. For distributed deployments, it is jupyterhub in the _user_ environment that needs patching. There are no patches necessary in the Hub environment. The only workaround is to make sure that only one JupyterLab tab is open when you log out.
Weakness: CWE-613
Which versions are affected by CVE-2021-41247?
4 open source packages ship an affected version, including jupyterhub. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
jupyterhub Bitnami | From 1.0.0 | 1.5.0 |
jupyterhub PyPI | From 1.0.0 | 1.5.0 |
jupyterhub PyPI | From 1.0.0 | 1.5.0 |
jupyterhub PyPI | From 1.0.0 | 1.5.0 |
Products include Jupyter Jupyterhub.
How do I fix CVE-2021-41247?
Upgrade jupyterhub to 1.5.0 or later.
Is CVE-2021-41247 being exploited?
There is no known exploitation of CVE-2021-41247 in the wild and no public exploit code.
Other vulnerabilities in jupyterhub
- CVE-2024-28233 XSS in JupyterHub via Self-XSS leveraged by Cookie Tossing
- CVE-2024-41942 JupyterHub has a privilege escalation vulnerability with the `admin:users` scope
- CVE-2019-10255 Open Redirect vulnerability in jupyterhub and notebook
- CVE-2026-40864 JupyterHub: Cross-origin form POSTs bypass XSRF
- CVE-2026-33709 JupyterHub has an Open Redirect Vulnerability
Sources
Also known as BIT-jupyterhub-2021-41247, DEBIAN-CVE-2021-41247, GHSA-cw7p-q79f-m2v7, PYSEC-2021-386.