CVE-2024-28188 jupyter-scheduler's endpoint is missing authentication
An attacker can access the list of conda environments for Jupyter Scheduler users, potentially revealing sensitive project information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-28188?
CVE-2024-28188 is a medium-severity missing authorization vulnerability in jupyter-server jupyter-scheduler, published on 23 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Jupyter Scheduler is collection of extensions for programming jobs to run now or run on a schedule. The list of conda environments of `jupyter-scheduler` users maybe be exposed, potentially revealing information about projects that a specific user may be working on. This vulnerability has been patched in version(s) 1.1.6, 1.2.1, 1.8.2 and 2.5.2.
Which versions are affected by CVE-2024-28188?
9 open source packages ship an affected version, including jupyter-scheduler.
| Package | Affected | Fixed in |
|---|---|---|
jupyter-scheduler PyPI | From 1.0.0 | 1.1.6, 1.2.1, 1.8.2, 2.5.2 |
jupyter-scheduler PyPI | From 1.0.0 | 1.1.6 |
jupyter-scheduler PyPI | From 1.0.0 | 1.1.6 |
jupyter-scheduler PyPI | From 1.2.0 | 1.2.1 |
jupyter-scheduler PyPI | From 1.2.0 | 1.2.1 |
jupyter-scheduler PyPI | From 1.3.0 | 1.8.2 |
3 more packages
jupyter-scheduler PyPI | From 1.3.0 | 1.8.2 |
jupyter-scheduler PyPI | From 2.0.0 | 2.5.2 |
jupyter-scheduler PyPI | From 2.0.0 | 2.5.2 |
How do I fix CVE-2024-28188?
Upgrade jupyter-scheduler to a fixed version for your release line: 1.1.6, 1.2.1, 1.8.2 or 2.5.2.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-28188 being exploited?
There is no known exploitation of CVE-2024-28188 in the wild and no public exploit code.
Sources
Also known as GHSA-v9g2-g7j4-4jxc, PYSEC-2026-1479, UBUNTU-CVE-2024-28188.