CVE-2020-26261: Jupyterhub Systemdspawner

High severity, CVSS 7.9. EPSS: 0.5% chance of exploitation in the next 30 days.

jupyterhub-systemdspawner enables JupyterHub to spawn single-user notebook servers using systemd. In jupyterhub-systemdspawner before version 0.15 user API tokens issued to single-user servers are specified in the environment of systemd units. These tokens are incorrectly accessible to all users. In particular, the-littlest-jupyterhub is affected, which uses systemdspawner by default. This is patched in jupyterhub-systemdspawner v0.15

Affected products

• Jupyterhub Systemdspawner: before 0.15 (fixed in 0.15)

Published 2020-12-09. Last modified 2026-06-17.