CVE-2026-54338: JupyterHub: Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login
Impact
Invalid input to login resulted in unbounded logging output. Only form-based Authenticators (the default PAM Authenticator, but not the more widely used OAuthenticator) are affected.
Patches
Upgrade to 5.5.0.
Workarounds
Use an Authenticator that doesn't use a login form, such as OAuthenticator.
Other sources
JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and storage resources. This issue is fixed in version 5.5.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/jupyterhubto a version that resolves this vulnerability.Fixed in 5.5.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.5.0 - Configuration
Configure JupyterHub to use an Authenticator that doesn't present a login form (e.g., OAuthenticator) instead of a form-based Authenticator (default PAM Authenticator is affected).
JupyterHub Authenticator Use login form-based authenticator vs non-form authenticator = Use a non-form Authenticator such as OAuthenticator
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54338?
CVE-2026-54338 has a medium severity rating of 5.3.
How do I fix CVE-2026-54338?
To fix CVE-2026-54338, you should upgrade to JupyterHub version 5.5.0 or later.
What type of vulnerability is CVE-2026-54338?
CVE-2026-54338 is an unauthenticated denial of service vulnerability related to unbounded username logging.
Who is affected by CVE-2026-54338?
Users of JupyterHub prior to version 5.5.0 are affected by CVE-2026-54338.
What impact does CVE-2026-54338 have?
CVE-2026-54338 can lead to logging and storage consumption by allowing attacker-controlled usernames in failed login logs.