CVE-2021-41247 - CVE House
Back to Database
Status published Low CVE-2021-41247

incomplete logout in JupyterHub

Vulnerability Description

JupyterHub is an open source multi-user server for Jupyter notebooks. In affected versions users who have multiple JupyterLab tabs open in the same browser session, may see incomplete logout from the single-user server, as fresh credentials (for the single-user server only, not the Hub) reinstated after logout, if another active JupyterLab session is open while the logout takes place. Upgrade to JupyterHub 1.5. For distributed deployments, it is jupyterhub in the _user_ environment that needs patching. There are no patches necessary in the Hub environment. The only workaround is to make sure that only one JupyterLab tab is open when you log out.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-41247

Credits & Attribution

No credits recorded in the NVD database.

References

More from jupyterhub

View All →
CVE-2025-32428
Jupyter Remote Desktop Proxy makes TigerVNC accessible via the network and not just via a UNIX socket as intended
Critical 9
CVE-2024-41942
JupyterHub has a privilege escalation vulnerability with the `admin:users` scope
High 7.2
CVE-2024-37300
Globus `identity_provider` restriction ignored when used with `allow_all` in JupyterHub 5.0
High 8.1
CVE-2024-35225
Jupyter Server Proxy has a reflected XSS issue in host parameter
Critical 9.7
CVE-2024-29033
GoogleOAuthenticator.hosted_domain incorrectly verifies membership of an Google organization/workspace
High 7.5

Affected Vendor

Affected Software

jupyterhub
Vulnerable Versions:
>= 1.0.0, < 1.5.0 - jupyterhub (pip), < 1.2.0 - jupyterhub (helm)

Timeline

Official Publish: November 4th, 2021
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Weaknesses (CWE)

CWE-613

MITRE ATT&CK TTPs

T1539 Steal Web Session Cookie
Credential Access
T1078 Valid Accounts
Persistence
T1550 Use Alternate Authentication Material
Defense Evasion
T1021 Remote Services
Lateral Movement
T1562 Impair Defenses
Defense Evasion