# CVE-2021-41247: incomplete JupyterHub logout with simultaneous JupyterLab sessions

Source: https://junglewise.ai/threats/cve-2021-41247-incomplete-jupyterhub-logout-with-simultaneous-jupyterlab  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-11-04  
License: CC BY 4.0 with a link back

CVE-2021-41247 · Severity: low · CVSS 3.1 · Published 2021-11-04

JupyterHub is an open source multi-user server for Jupyter notebooks. In affected versions users who have multiple JupyterLab tabs open in the same browser session, may see incomplete logout from the single-user server, as fresh credentials (for the single-user server only, not the Hub) reinstated after logout, if another active JupyterLab session is open while the logout takes place. Upgrade to JupyterHub 1.5. For distributed deployments, it is jupyterhub in the _user_ environment that needs patching. There are no patches necessary in the Hub environment. The only workaround is to make sure that only one JupyterLab tab is open when you log out.

Technologies: [jupyterhub (PyPI)](https://junglewise.ai/threats/technologies/jupyterhub). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2021-41247 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-41247 being exploited in the wild.

**How severe is CVE-2021-41247?** Low severity, with a CVSS score of 3.1, published 4 November 2021.

**Which products and versions are affected?** jupyterhub (PyPI) ECOSYSTEM:introduced=1.0.0,fixed=1.5.0, GIT:introduced=0,fixed=5ac9e7f73a6e1020ffddc40321fc53336829fe27|ECOSYSTEM:introduced=1.0.0,fixed=1.5.0.

**Is there a fix for CVE-2021-41247?** Yes. jupyterhub (PyPI): upgrade to 1.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2021-41247?** Check whether you run jupyterhub (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- jupyterhub (PyPI): upgrade to 1.5.0 or later

  ```sh
  pip install "jupyterhub>=1.5.0"
  ```


## Affected products

- jupyterhub (PyPI) ECOSYSTEM:introduced=1.0.0,fixed=1.5.0, GIT:introduced=0,fixed=5ac9e7f73a6e1020ffddc40321fc53336829fe27|ECOSYSTEM:introduced=1.0.0,fixed=1.5.0

## Identifiers

- CVE-2021-41247
- GHSA-cw7p-q79f-m2v7
- PYSEC-2021-386

## Related threats

- [JupyterHub unauthenticated denial of service in login form handling](https://junglewise.ai/threats/cve-2026-54338-jupyterhub-unauthenticated-denial-of-service-in-login-form)
- [PYSEC-2026-1480 - Cross site scripting (XSS) in JupyterHub via Self-XSS leveraged by Cookie Tossing](https://junglewise.ai/threats/cve-2024-28233-cross-site-scripting-xss-in-jupyterhub-via-self-xss-leveraged-by)
- [PYSEC-2026-647 - Open Redirect vulnerability in jupyterhub and notebook](https://junglewise.ai/threats/cve-2019-10255-open-redirect-vulnerability-in-jupyterhub-and-notebook)
- [JupyterHub XSRF protection bypass in HTTP form endpoints](https://junglewise.ai/threats/cve-2026-40864-jupyterhub-xsrf-protection-bypass-in-http-form-endpoints)
- [Jupyter JupyterHub open redirect vulnerability](https://junglewise.ai/threats/cve-2026-33709-jupyter-jupyterhub-open-redirect-vulnerability)