CVE-2026-44181: Jupyter Enterprise Gateway SSTI in Kubernetes manifest rendering

CVE-2026-44181 · Severity: critical · CVSS 10 · Published 2026-07-16

Jupyter Enterprise Gateway is a tool used to manage and launch computing tasks across large clusters like Kubernetes and Apache Spark. A security flaw allows attackers to inject malicious code into the system by manipulating environment variables used during task setup. This could allow an attacker to take full control of the underlying Kubernetes cluster, steal sensitive data, or disrupt operations.

Technologies: Jupyter Enterprise Gateway, jupyter_enterprise_gateway (PyPI). Vendors: Jupyter, PyPI.

Quick answers

Is CVE-2026-44181 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44181 being exploited in the wild.
How severe is CVE-2026-44181?
Critical severity, with a CVSS score of 10, published 16 July 2026.
Which products and versions are affected?
Jupyter Enterprise Gateway >= 2.0.0rc2, < 3.3.0; jupyter_enterprise_gateway (PyPI) >= 2.0.0rc2, < 3.3.0.
Is there a fix for CVE-2026-44181?
A patch was published on 2026-06-01: Version 3.3.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44181 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-44181?
Check whether you run Jupyter Enterprise Gateway or jupyter_enterprise_gateway (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Jupyter Enterprise Gateway versions 2.0.0rc2 through 3.2.3 are vulnerable to Server-Side Template Injection (SSTI) via Jinja2 template expressions. The vulnerability exists in the `k8s.py` component and `kernel-pod.yaml.j2` template, where environment variables prefixed with `KERNEL_` (such as `KERNEL_POD_NAME` and `KERNEL_WORKING_DIR`) are rendered without sufficient sanitization. An unauthenticated remote attacker can provide malicious Jinja2 expressions in an API request to execute arbitrary Python code or OS commands within the Enterprise Gateway service. This can lead to the theft of Kubernetes service account tokens, enabling the attacker to read secrets or schedule privileged pods, resulting in a full compromise of the Kubernetes cluster. The issue is fixed in version 3.3.0.

Affected products

  • jupyter-server jupyter_enterprise_gateway >= 2.0.0rc2, < 3.3.0

Identifiers

  • CVE-2026-44181
  • GHSA-f49j-v924-fx9w

Timeline

  • 2026-06-01: patched: Version 3.3.0 released
  • 2026-06-03: advisory: GitHub Security Advisory published
  • 2026-07-16: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.