CVE-2024-41942 JupyterHub has a privilege escalation vulnerability with the `admin:users` scope
Users with admin:users scope can escalate to full admin privileges in JupyterHub, requiring an upgrade to patched versions.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-41942?
CVE-2024-41942 is a high-severity vulnerability in jupyterhub, published on 8 Aug 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks. Prior to versions 4.1.6 and 5.1.0, if a user is granted the `admin:users` scope, they may escalate their own privileges by making themselves a full admin user. The impact is relatively small in that `admin:users` is already an extremely privileged scope only granted to trusted users. In effect, `admin:users` is equivalent to `admin=True`, which is not intended. Note that the change here only prevents escalation to the built-in JupyterHub admin role that has unrestricted permissions. It does not prevent users with e.g. `groups` permissions from granting themselves or other users permissions via group membership, which is intentional. Versions 4.1.6 and 5.1.0 fix this issue.
Weakness: CWE-274
Which versions are affected by CVE-2024-41942?
6 open source packages ship an affected version, including jupyterhub. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
jupyterhub Bitnami | All versions | 4.1.6, 5.1.0 |
jupyterhub PyPI | All versions | 4.1.6 |
jupyterhub PyPI | All versions | 4.1.6 |
jupyterhub PyPI | All versions | 4.1.6 |
jupyterhub PyPI | From 5.0.0 | 5.1.0 |
jupyterhub PyPI | From 5.0.0 | 5.1.0 |
Products include Jupyter Jupyterhub.
How do I fix CVE-2024-41942?
Upgrade jupyterhub to a fixed version for your release line: 4.1.6 or 5.1.0.
Is CVE-2024-41942 being exploited?
There is no known exploitation of CVE-2024-41942 in the wild and no public exploit code.
Other vulnerabilities in jupyterhub
- CVE-2024-28233 XSS in JupyterHub via Self-XSS leveraged by Cookie Tossing
- CVE-2019-10255 Open Redirect vulnerability in jupyterhub and notebook
- CVE-2026-40864 JupyterHub: Cross-origin form POSTs bypass XSRF
- CVE-2026-33709 JupyterHub has an Open Redirect Vulnerability
- CVE-2020-36191 Cross-Site Request Forgery in JupyterHub
Sources
Also known as BIT-jupyterhub-2024-41942, DEBIAN-CVE-2024-41942, GHSA-9x4q-3gxw-849f, PYSEC-2024-200, UBUNTU-CVE-2024-41942.