PYSEC-2026-1479

Vulnerability from pysec - Published: 2026-07-07 11:45 - Updated: 2026-07-07 17:24
VLAI
Details

Impact

jupyter_scheduler is missing an authentication check in Jupyter Server on an API endpoint (GET /scheduler/runtime_environments) which lists the names of the Conda environments on the server. In affected versions, jupyter_scheduler allows an unauthenticated user to obtain the list of Conda environment names on the server. This reveals any information that may be present in a Conda environment name.

This issue does not allow an unauthenticated third party to read, modify, or enter the Conda environments present on the server where jupyter_scheduler is running. This issue only reveals the list of Conda environment names.

Impacted versions: >=1.0.0,<=1.1.5 ; ==1.2.0 ; >=1.3.0,<=1.8.1 ; >=2.0.0,<=2.5.1

Patches

  • jupyter-scheduler==1.1.6
  • jupyter-scheduler==1.2.1
  • jupyter-scheduler==1.8.2
  • jupyter-scheduler==2.5.2

Workarounds

Server operators who are unable to upgrade can disable the jupyter-scheduler extension with:

jupyter server extension disable jupyter-scheduler

References

If you have any questions or comments about this advisory we ask that you contact AWS/Amazon Security via our vulnerability reporting page [1] or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.

[1] Vulnerability reporting page: https://aws.amazon.com/security/vulnerability-reporting

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Impacted products
Name purl
jupyter-scheduler pkg:pypi/jupyter-scheduler
Aliases
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "jupyter-scheduler",
        "purl": "pkg:pypi/jupyter-scheduler"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.0.0"
            },
            {
              "fixed": "1.1.6"
            },
            {
              "introduced": "1.2.0"
            },
            {
              "fixed": "1.2.1"
            },
            {
              "introduced": "1.3.0"
            },
            {
              "fixed": "1.8.2"
            },
            {
              "introduced": "2.0.0"
            },
            {
              "fixed": "2.5.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.0.0",
        "1.1.0",
        "1.1.1",
        "1.1.2",
        "1.1.3",
        "1.1.4",
        "1.1.5",
        "1.2.0",
        "1.3.0",
        "1.3.1",
        "1.3.2",
        "1.3.3",
        "1.3.4",
        "1.4.0",
        "1.5.0",
        "1.6.0",
        "1.7.0",
        "1.8.0",
        "1.8.1",
        "2.0.0",
        "2.1.0",
        "2.2.0",
        "2.3.0",
        "2.4.0",
        "2.5.0",
        "2.5.1"
      ]
    }
  ],
  "aliases": [
    "CVE-2024-28188",
    "GHSA-v9g2-g7j4-4jxc"
  ],
  "details": "### Impact\n\n`jupyter_scheduler` is missing an authentication check in Jupyter Server on an API endpoint (`GET /scheduler/runtime_environments`) which lists the names of the Conda environments on the server. In affected versions, `jupyter_scheduler` allows an unauthenticated user to obtain the list of Conda environment names on the server. This reveals any information that may be present in a Conda environment name.\n\nThis issue does **not** allow an unauthenticated third party to read, modify, or enter the Conda environments present on the server where `jupyter_scheduler` is running. This issue only reveals the list of Conda environment names.\n\nImpacted versions: `\u003e=1.0.0,\u003c=1.1.5 ; ==1.2.0 ; \u003e=1.3.0,\u003c=1.8.1 ; \u003e=2.0.0,\u003c=2.5.1`\n\n### Patches\n\n* `jupyter-scheduler==1.1.6`\n* `jupyter-scheduler==1.2.1`\n* `jupyter-scheduler==1.8.2`\n* `jupyter-scheduler==2.5.2`\n\n### Workarounds\n\nServer operators who are unable to upgrade can disable the `jupyter-scheduler` extension with:\n\n```\njupyter server extension disable jupyter-scheduler\n```\n\n### References\n\nIf you have any questions or comments about this advisory we ask that you contact AWS/Amazon Security via our vulnerability reporting page [1] or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.\n\n[1] Vulnerability reporting page: https://aws.amazon.com/security/vulnerability-reporting\n",
  "id": "PYSEC-2026-1479",
  "modified": "2026-07-07T17:24:22.791353Z",
  "published": "2026-07-07T11:45:43.373639Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/jupyter-server/jupyter-scheduler/security/advisories/GHSA-v9g2-g7j4-4jxc"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28188"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jupyter-server/jupyter_server/pull/1392"
    },
    {
      "type": "FIX",
      "url": "https://github.com/jupyter-server/jupyter-scheduler/commit/06435a2277bb2b8f441ec9cedafa474572b92c5d"
    },
    {
      "type": "FIX",
      "url": "https://github.com/jupyter-server/jupyter-scheduler/commit/a621b386397280cc8ee5a208dca4607cb71cdd65"
    },
    {
      "type": "FIX",
      "url": "https://github.com/jupyter-server/jupyter-scheduler/commit/d428ac871909444e175ba421bf8ab4980d6ebf9f"
    },
    {
      "type": "FIX",
      "url": "https://github.com/jupyter-server/jupyter-scheduler/commit/f4137a779fdf0cc4a9688a42dd8c6e7ade60f044"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jupyter-server/jupyter-scheduler"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/jupyter-scheduler"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-v9g2-g7j4-4jxc"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "jupyter-scheduler\u0027s endpoint is missing authentication"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.