CVE-2026-54338
MediumAdvisory
Published 25 Aug 2026In the index since 6 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 5.3
- base score, highest
- EPSS
- 0.004
- 36th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 14
- of 17,957 indexed, latest versions
- Container images
- 20
- deployed by those charts
- Fix available
- 1 of 1
- affected package
JupyterHub has Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login
Carried by container images the latest versions of 14 of 17,957 indexed charts deploy, on 20 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| jupyterhubpypi | 0.9.4, 1.1.0, 1.3.0, 1.4.0+9 more | 5.5.0 | 20 |
- OSV records
- GHSA-p43p-whwx-q52h
- Also known as
- BIT-jupyterhub-2026-54338, PYSEC-2026-3853
Charts affected
14 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| fadicetic | 0.3.1 | 2 of 25See more | 137,043 |
| daskhubdask | 2024.1.1 | 2 of 9See more | 14,861 |
| pysequilabiodatageeks | 0.1.3 | 1 of 7See more | 90,841 |
| jupyterhub-outpostjupyter-jscVerified publisher | 2.4.1 | 1 of 1See more | 1,840 |
| daskcloudnativeapp | 2.2.1 | 1 of 2See more | 30,448 |
| codehubcodehubVerified publisher | 6.2.18 | 1 of 5See more | 14,240 |
| jupyterhubd4nVerified publisher | 3.3.7 | 2 of 7See more | 17,520 |
| helixhelix | 1.4.3 | 1 of 2See more | 6,131 |
| jupyterhubhelmforgeVerified publisher | 1.0.6 | 1 of 3See more | 5,903 |
| ikigaiikigai-chartVerified publisher | 0.0.9 | 1 of 58See more | 117,870 |
| jupyterhubkubeblocksVerified publisher | 0.1.0 | 2 of 7See more | 7,645 |
| nubladolsst-sqre | 0.9.23 | 3 of 5See more | 6,150 |
| nublado2lsst-sqre | 0.8.5 | 1 of 2See more | 95,443 |
| jupyterhubuninettsigma2 | 1.6.0 | 1 of 5See more | 9,013 |
Container images carrying it
20 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| aristidetm/ | 469dbc951224 | jupyterhub | 5.5.0 | 1 |
| aristidetm/ | ccb516cb8474 | jupyterhub | 5.5.0 | 1 |
| daskdev/ | 052630f5ca04 | jupyterhub | 5.5.0 | 1 |
| jupyterhub/ | 3974ba945e65 | jupyterhub | 5.5.0 | 1 |
| jupyterhub/ | 5a0ceed1300a | jupyterhub | 5.5.0 | 1 |
| jupyterhub/ | b6b4a1a34bf0 | jupyterhub | 5.5.0 | 1 |
| jupyterhub/ | e4770285aaf7 | jupyterhub | 5.5.0 | 1 |
| jupyterhub/ | ec78bdae0fed | jupyterhub | 5.5.0 | 1 |
| jupyterhub/ | 8e4778efec8e | jupyterhub | 5.5.0 | 1 |
| jupyterhub/ | e3e6f3051df8 | jupyterhub | 5.5.0 | 1 |
| jupyterjsc/ | aea53b13f235 | jupyterhub | 5.5.0 | 1 |
| lsstsqre/ | b75bf8aaafa4 | jupyterhub | 5.5.0 | 1 |
| lsstsqre/ | 19c2dfc4e4ff | jupyterhub | 5.5.0 | 1 |
| lsstsqre/ | 5e0ade6bed1c | jupyterhub | 5.5.0 | 1 |
| lsstsqre/ | e9feb99f524d | jupyterhub | 5.5.0 | 1 |
| pangeo/ | 5fbe688a4f80 | jupyterhub | 5.5.0 | 1 |
| quay.io/ | 113e372cf71b | jupyterhub | 5.5.0 | 1 |
| quay.io/ | 2528c6e57587 | jupyterhub | 5.5.0 | 1 |
| quay.io/ | 92f883d09270 | jupyterhub | 5.5.0 | 1 |
| quay.io/ | cae8c0622533 | jupyterhub | 5.5.0 | 1 |