CVE-2020-36191: Jupyter Jupyterhub

Medium severity, CVSS 4.5. EPSS: 0.5% chance of exploitation in the next 30 days.

JupyterHub 1.1.0 allows CSRF in the admin panel via a request that lacks an _xsrf field, as demonstrated by a /hub/api/user request (to add or remove a user account).

Affected products

• Jupyter Jupyterhub: version 1.1.0 only

Published 2021-01-13. Last modified 2026-06-17.