Executive brief
Jupyter Enterprise Gateway is a tool used to manage and launch computing tasks across large clusters like Kubernetes and Apache Spark. A security flaw allows attackers to inject malicious code into the system by manipulating environment variables used during task setup. This could allow an attacker to take full control of the underlying Kubernetes cluster, steal sensitive data, or disrupt operations.
Technical details
Jupyter Enterprise Gateway versions 2.0.0rc2 through 3.2.3 are vulnerable to Server-Side Template Injection (SSTI) via Jinja2 template expressions. The vulnerability exists in the `k8s.py` component and `kernel-pod.yaml.j2` template, where environment variables prefixed with `KERNEL_` (such as `KERNEL_POD_NAME` and `KERNEL_WORKING_DIR`) are rendered without sufficient sanitization. An unauthenticated remote attacker can provide malicious Jinja2 expressions in an API request to execute arbitrary Python code or OS commands within the Enterprise Gateway service. This can lead to the theft of Kubernetes service account tokens, enabling the attacker to read secrets or schedule privileged pods, resulting in a full compromise of the Kubernetes cluster. The issue is fixed in version 3.3.0.
Affected products
- jupyter-server jupyter_enterprise_gateway >= 2.0.0rc2, < 3.3.0
Timeline
- 2026-06-01: patched: Version 3.3.0 released
- 2026-06-03: advisory: GitHub Security Advisory published
- 2026-07-16: disclosed: CVE published to NVD