CVE-2020-36191: JupyterHub CSRF Vulnerability
Summary
CVE-2020-36191: JupyterHub 1.1.0 allows CSRF in the admin panel via a request that lacks an _xsrf field, as demonstrated by a /hub/api/user request (to add or remove a user account). Affects jupyterhub versions < 1.2.0b1. Fixed in 1.2.0b1. How to fix ↓
Also tracked for
- jupyterhub · Bitnami
- jupyterhub · Debian:12
The same CVE-2020-36191 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
JupyterHub is an open-source platform that allows multiple users to access and interact with Jupyter notebooks. It provides a centralized hub for managing and authenticating user accounts. JupyterHub is widely used in educational institutions and data science teams for collaborative work. However, a vulnerability has been discovered in JupyterHub version 1.1.0 that allows Cross-Site Request Forgery (CSRF) attacks in the admin panel.
Vulnerability Detail
The vulnerability in JupyterHub version 1.1.0 arises from a lack of proper Cross-Site Request Forgery (CSRF) protection in the admin panel. When a request is made to the '/hub/api/user' endpoint to add or remove a user account, it does not include the required '_xsrf' field. This omission allows an attacker to craft malicious requests that can perform unauthorized actions on behalf of an authenticated user. An attacker could exploit this vulnerability to add or remove user accounts without proper authorization, potentially leading to unauthorized access or privilege escalation.
How To Fix
Latest published version: 6.1.1 as of 22 Oct 2026
pip install --upgrade "jupyterhub==6.1.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.2.0b1
This is the first release that contains the fix.
pip install --upgrade "jupyterhub==1.2.0b1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to a fixed version of JupyterHub.
Conclusion
The CSRF vulnerability in JupyterHub version 1.1.0 can allow unauthorized actions in the admin panel, potentially leading to unauthorized access or privilege escalation. It is crucial to upgrade to a fixed version of JupyterHub (1.2.0b1 or later) to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for jupyterhub →
FAQ
JupyterHub is an open-source platform that allows multiple users to access and interact with Jupyter notebooks. It provides a centralized hub for managing and authenticating user accounts.
Cross-Site Request Forgery (CSRF) is an attack that tricks the victim into submitting a malicious request. In this vulnerability, an attacker can exploit CSRF to perform unauthorized actions on behalf of an authenticated user in the JupyterHub admin panel.
The CSRF vulnerability in JupyterHub can allow an attacker to add or remove user accounts without proper authorization. This could lead to unauthorized access, privilege escalation, and potential data breaches.
You can use the Vulert playground at Vulert Scanner to check if your JupyterHub installation is affected by this vulnerability. Simply provide your Pipfile.lock file, and Vulert will analyze it for any open-source vulnerabilities, including this CSRF vulnerability.
You can find more information about this vulnerability in the JupyterHub advisory database at https://github.com/pypa/advisory-database/blob/main/vulns/jupyterhub/PYSEC-2021-67.yaml
References
Related vulnerabilities
Recent vulnerabilities recorded for jupyterhub.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
