Executive brief
Jupyter Enterprise Gateway is a tool used to launch and manage computing resources across distributed clusters like Kubernetes and Docker. A security flaw allows attackers to manipulate the configuration files used to create these resources by injecting malicious commands into environment variables. This could allow an attacker to bypass security controls, create unauthorized high-privileged containers, and potentially gain full control over the underlying cluster infrastructure.
Technical details
Jupyter Enterprise Gateway prior to version 3.3.0 is vulnerable to YAML injection during the rendering of Kubernetes manifests via Jinja2 templates. The server interpolates untrusted environment variables (prefixed with KERNEL_) into templates without proper YAML-aware escaping. An attacker can provide malicious input through these variables to inject new fields, overwrite existing securityContext keys (where the last defined key prevails), or use YAML document boundaries (---) to define and create entirely new, unauthorized Kubernetes resources such as privileged pods. This vulnerability is exploitable via the API when requesting new kernels. The issue is fixed in version 3.3.0 by implementing proper escaping and validation.
Affected products
- jupyter-server jupyter_enterprise_gateway < 3.3.0
Timeline
- 2026-06-01: patched: Version 3.3.0 released
- 2026-06-03: advisory: GitHub Security Advisory published
- 2026-07-16: disclosed: CVE published to NVD