# \#security

**URL:** https://discourse.jupyter.org/tag/security/36.md

[Latest](https://discourse.jupyter.org/latest.md) · [Categories](https://discourse.jupyter.org/categories.md) · [Tags](https://discourse.jupyter.org/tags.md)

---

## [\[ANN\] JupyterHub 5.5.1 security release](https://discourse.jupyter.org/t/ann-jupyterhub-5-5-1-security-release/38821)

<div class="topic-metadata">

**Author:** [@minrk](https://discourse.jupyter.org/u/minrk)\
**Replies:** 0\
**Last updated:** [August 10, 2026, 10:42pm UTC](https://discourse.jupyter.org/t/ann-jupyterhub-5-5-1-security-release/38821 "2026-08-10T22:42:55Z")

</div>

We’ve just released JupyterHub 5.5.1, fixing two security vulnerabilities, neither of which affect default configurations: GHSA-c4gm-pwx9-9w8j (CVE pending) high-level vulnerability in user-initiated sharing (no effect…

---

## [JupyterLab Desktop 4.6.2-1 is out: critical security patches](https://discourse.jupyter.org/t/jupyterlab-desktop-4-6-2-1-is-out-critical-security-patches/38799)

<div class="topic-metadata">

**Author:** [@krassowski](https://discourse.jupyter.org/u/krassowski)\
**Replies:** 0\
**Last updated:** [July 24, 2026, 11:00am UTC](https://discourse.jupyter.org/t/jupyterlab-desktop-4-6-2-1-is-out-critical-security-patches/38799 "2026-07-24T11:00:09Z")

</div>

After a two-year long hiatus, JupyterLab Desktop 4.6.2-1 is out with patches for two critical and two moderate severity vulnerabilities: GHSA-vrj4-r4fw-9rfh - pasting a malicious server URL into the connect dialog c…

---

## [Question Regarding Server-Side Behavior after Logout](https://discourse.jupyter.org/t/question-regarding-server-side-behavior-after-logout/38459)

<div class="topic-metadata">

**Author:** [@heffalump](https://discourse.jupyter.org/u/heffalump)\
**Replies:** 1\
**Last updated:** [March 13, 2026, 4:36pm UTC](https://discourse.jupyter.org/t/question-regarding-server-side-behavior-after-logout/38459 "2026-03-13T16:36:53Z")

</div>

Hello, I have a question about the logout behavior in The Littlest JupyterHub (TLJH), specifically regarding the jupyterhub-hub-login cookie. When a user logs into The Littlest JupyterHub (TLJH), the browser receives a…

---

## [Is there actually a way of setting the content-security-policy headers served by a hub installation?](https://discourse.jupyter.org/t/is-there-actually-a-way-of-setting-the-content-security-policy-headers-served-by-a-hub-installation/37988)

<div class="topic-metadata">

**Author:** [@gutow](https://discourse.jupyter.org/u/gutow)\
**Replies:** 5\
**Last updated:** [October 8, 2025, 11:14pm UTC](https://discourse.jupyter.org/t/is-there-actually-a-way-of-setting-the-content-security-policy-headers-served-by-a-hub-installation/37988 "2025-10-08T23:14:48Z")

</div>

I have a use case (Latex + plotly + Jupyter) where I need to allow pages to embed an iframe in the cell output. This works fine with a local Jupyter installation, but when served from a user’s spawned server on a Jupyter…

---

## [Trouble Configuring Internal SSL with a custom service running](https://discourse.jupyter.org/t/trouble-configuring-internal-ssl-with-a-custom-service-running/37144)

<div class="topic-metadata">

**Author:** [@heffalump](https://discourse.jupyter.org/u/heffalump)\
**Replies:** 5\
**Last updated:** [August 1, 2025, 2:05pm UTC](https://discourse.jupyter.org/t/trouble-configuring-internal-ssl-with-a-custom-service-running/37144 "2025-08-01T14:05:20Z")

</div>

I have a Jupyter Hub deployment and currently I am trying to set up internal SSL. However, I think I am having issues because of a custom service that I wrote. I’m a bit green when it comes to certificate configuration, …

---

## [Google Cloud Armor WAF Rules for JupyterHub](https://discourse.jupyter.org/t/google-cloud-armor-waf-rules-for-jupyterhub/33974)

<div class="topic-metadata">

**Author:** [@jrdnbradford](https://discourse.jupyter.org/u/jrdnbradford)\
**Replies:** 0\
**Last updated:** [March 21, 2025, 2:51pm UTC](https://discourse.jupyter.org/t/google-cloud-armor-waf-rules-for-jupyterhub/33974 "2025-03-21T14:51:13Z")

</div>

For anyone running JupyterHub behind a load balancer on Google Cloud: what preconfigured Cloud Armor Web Application Firewall Rules do you use? I’d be interested in hearing what rules/configurations are used by others.

---

## [How to conduct notebook level access control for users?](https://discourse.jupyter.org/t/how-to-conduct-notebook-level-access-control-for-users/33310)

<div class="topic-metadata">

**Author:** [@zjia](https://discourse.jupyter.org/u/zjia)\
**Replies:** 0\
**Last updated:** [February 27, 2025, 9:08pm UTC](https://discourse.jupyter.org/t/how-to-conduct-notebook-level-access-control-for-users/33310 "2025-02-27T21:08:06Z")

</div>

I would like to make a role based access control for specific notebooks. I read this doc Security in the Jupyter Server — Jupyter Server documentation. I tried to customize the jupyter\_server.auth.Authorizer. However, i…

---

## [Jupyter requests token remotely but requests (unknown) password locally](https://discourse.jupyter.org/t/jupyter-requests-token-remotely-but-requests-unknown-password-locally/29088)

<div class="topic-metadata">

**Author:** [@Jupyter-Jones](https://discourse.jupyter.org/u/Jupyter-Jones)\
**Replies:** 0\
**Last updated:** [October 10, 2024, 8:02am UTC](https://discourse.jupyter.org/t/jupyter-requests-token-remotely-but-requests-unknown-password-locally/29088 "2024-10-10T08:02:14Z")

</div>

Dear Jupyter experts, I would like to use Jupyter Notebooks on a remote machine. I have a VNC connection to that machine and I have successfully started a jupyter server on it by typing jupyter notebook. The server appe…

---

## [\[ANN\] Security releases: JupyterHub 4.1.6, 5.1.0](https://discourse.jupyter.org/t/ann-security-releases-jupyterhub-4-1-6-5-1-0/27312)

<div class="topic-metadata">

**Author:** [@minrk](https://discourse.jupyter.org/u/minrk)\
**Replies:** 1\
**Last updated:** [August 8, 2024, 8:25am UTC](https://discourse.jupyter.org/t/ann-security-releases-jupyterhub-4-1-6-5-1-0/27312 "2024-08-08T08:25:39Z")

</div>

We’ve published JupyterHub 5.1.0 which has some nice fixes and improvements over 5.0.0. 5.1.0 also fixes a security issue (CVE-2024-41942). An advisory for the vulnerability will be published in 7 days, to give folks a…

---

## [Is it possible to encrypt username on the URL?](https://discourse.jupyter.org/t/is-it-possible-to-encrypt-username-on-the-url/27276)

<div class="topic-metadata">

**Author:** [@Sarunas\_Azna](https://discourse.jupyter.org/u/Sarunas_Azna)\
**Replies:** 5\
**Last updated:** [July 30, 2024, 10:45am UTC](https://discourse.jupyter.org/t/is-it-possible-to-encrypt-username-on-the-url/27276 "2024-07-30T10:45:31Z")

</div>

Current URL scheme of the user servers is: /user/:username\[/:servername\] (JupyterHub URL scheme — JupyterHub documentation) Username can be an email, so real life example could be: /user/my\_email@org.org/lab Above s…

---

## [\[ANN\] Critical security fix in jupyter-server-proxy](https://discourse.jupyter.org/t/ann-critical-security-fix-in-jupyter-server-proxy/26261)

<div class="topic-metadata">

**Author:** [@manics](https://discourse.jupyter.org/u/manics)\
**Replies:** 0\
**Last updated:** [June 11, 2024, 9:09pm UTC](https://discourse.jupyter.org/t/ann-critical-security-fix-in-jupyter-server-proxy/26261 "2024-06-11T21:09:15Z")

</div>

jupyter-server-proxy versions 4.2.0 and 3.2.4 were released today with a fix for a critical cross-site scripting (XSS) vulnerability. Please update your installations as soon as possible. For more details see CVE-2024-3…

---

## [Interpreting the Security Docs](https://discourse.jupyter.org/t/interpreting-the-security-docs/25855)

<div class="topic-metadata">

**Author:** [@rryoung98](https://discourse.jupyter.org/u/rryoung98)\
**Replies:** 4\
**Last updated:** [May 24, 2024, 10:40am UTC](https://discourse.jupyter.org/t/interpreting-the-security-docs/25855 "2024-05-24T10:40:26Z")

</div>

hello, i just have a quick question about the security documentation for the latest jupyterhub Security Overview — JupyterHub documentation In particular we are looking to include RTC on our jupyterhub / jupyterlab and …

---

## [Limit user access to host system](https://discourse.jupyter.org/t/limit-user-access-to-host-system/23450)

<div class="topic-metadata">

**Author:** [@andarang](https://discourse.jupyter.org/u/andarang)\
**Replies:** 2\
**Last updated:** [January 16, 2024, 2:32pm UTC](https://discourse.jupyter.org/t/limit-user-access-to-host-system/23450 "2024-01-16T14:32:35Z")

</div>

Hello! I have set up JupyterHub with the littlest JupyterHub (tljh). It is running on premise and on a university network over HTTPS. As a normal user, I can spawn a terminal, and I can navigate through the server, so po…

---

## [Bug bounty program](https://discourse.jupyter.org/t/bug-bounty-program/20724)

<div class="topic-metadata">

**Author:** [@jweill-aws](https://discourse.jupyter.org/u/jweill-aws)\
**Replies:** 1\
**Last updated:** [November 23, 2023, 10:51pm UTC](https://discourse.jupyter.org/t/bug-bounty-program/20724 "2023-11-23T22:51:31Z")

</div>

With funding from the European Commission, Jupyter has a new bug bounty program. You can earn monetary awards for finding key bugs in Jupyter Server, JupyterLab, and JupyterHub. Terms and conditions apply.

---

## [DockerSpawner 13 release](https://discourse.jupyter.org/t/dockerspawner-13-release/22525)

<div class="topic-metadata">

**Author:** [@minrk](https://discourse.jupyter.org/u/minrk)\
**Replies:** 0\
**Last updated:** [November 21, 2023, 6:08pm UTC](https://discourse.jupyter.org/t/dockerspawner-13-release/22525 "2023-11-21T18:08:31Z")

</div>

DockerSpawner 13.0 has been released, which includes several fixes, most notably a security fix for validating user-requested images to launch. Upgrade via pip or conda: pip install --upgrade dockerspawner A security a…

---

## [Ssh key file permissions are set to 660 on every log in](https://discourse.jupyter.org/t/ssh-key-file-permissions-are-set-to-660-on-every-log-in/15356)

<div class="topic-metadata">

**Author:** [@Taylor\_Gibson](https://discourse.jupyter.org/u/Taylor_Gibson)\
**Replies:** 5\
**Last updated:** [October 20, 2023, 5:23pm UTC](https://discourse.jupyter.org/t/ssh-key-file-permissions-are-set-to-660-on-every-log-in/15356 "2023-10-20T17:23:12Z")

</div>

Hi all, I’ve created an ssh keypair in my persistent user storage in the folder ~/.ssh/. This key was verified to work correctly and I was able to successfully make a commit and put on my github account, both from the c…

---

## [Configure spawned notebook policy in PSS enforced kubernetes environment](https://discourse.jupyter.org/t/configure-spawned-notebook-policy-in-pss-enforced-kubernetes-environment/20187)

<div class="topic-metadata">

**Author:** [@sde31](https://discourse.jupyter.org/u/sde31)\
**Replies:** 2\
**Last updated:** [September 18, 2023, 1:50pm UTC](https://discourse.jupyter.org/t/configure-spawned-notebook-policy-in-pss-enforced-kubernetes-environment/20187 "2023-09-18T13:50:51Z")

</div>

Hello, I’m facing an issue with a deployed z2jh helm chart running in a cluster that apply restricted policy PSS/PSP. I’ve added necessary security context to helm values for the hub the hub and the proxy, it works fin…

---

## [Can single-user instances authenticate access to shared notebooks?](https://discourse.jupyter.org/t/can-single-user-instances-authenticate-access-to-shared-notebooks/16212)

<div class="topic-metadata">

**Author:** [@johninbaltimore](https://discourse.jupyter.org/u/johninbaltimore)\
**Replies:** 3\
**Last updated:** [October 11, 2022, 8:34pm UTC](https://discourse.jupyter.org/t/can-single-user-instances-authenticate-access-to-shared-notebooks/16212 "2022-10-11T20:34:36Z")

</div>

I’m new to this and just trying to figure out how to set up JupyterHub with per-user subdomains and suchlike. Two important questions: are we able to restrict notebooks in single-user instances to authenticated users? …

---

## [Jupyterlab accepts arbitrary value in /login's "next" parameter](https://discourse.jupyter.org/t/jupyterlab-accepts-arbitrary-value-in-logins-next-parameter/20852)

<div class="topic-metadata">

**Author:** [@Adam\_Tworkiewicz](https://discourse.jupyter.org/u/Adam_Tworkiewicz)\
**Replies:** 1\
**Last updated:** [August 11, 2023, 6:49am UTC](https://discourse.jupyter.org/t/jupyterlab-accepts-arbitrary-value-in-logins-next-parameter/20852 "2023-08-11T06:49:43Z")

</div>

Hi, we use Jupyterlab in one of our products. A security audit flagged Jupyterlab’s behavior of /login endpoint. The endpoint accepts “next” parameter. The parameter controls where users will be redirected next after suc…

---

## [Security issues with jupyterhub-hub-login cookie](https://discourse.jupyter.org/t/security-issues-with-jupyterhub-hub-login-cookie/19862)

<div class="topic-metadata">

**Author:** [@Hazahim](https://discourse.jupyter.org/u/Hazahim)\
**Replies:** 7\
**Last updated:** [June 21, 2023, 4:06am UTC](https://discourse.jupyter.org/t/security-issues-with-jupyterhub-hub-login-cookie/19862 "2023-06-21T04:06:25Z")

</div>

Hi team, we are right now facing security related issue with Jupyterhub using kubespawner and AD Authentication. If User B replaces his cookie(jupyterhub-hub-login) with same of User A, he would be able to access Notebo…

---

## [How to improve security in nginx bloc for jupyterhub](https://discourse.jupyter.org/t/how-to-improve-security-in-nginx-bloc-for-jupyterhub/19122)

<div class="topic-metadata">

**Author:** [@arnome](https://discourse.jupyter.org/u/arnome)\
**Replies:** 3\
**Last updated:** [June 16, 2023, 8:02pm UTC](https://discourse.jupyter.org/t/how-to-improve-security-in-nginx-bloc-for-jupyterhub/19122 "2023-06-16T20:02:29Z")

</div>

Hi everyone, I have set up a jupyterhub server with nginx as reverse proxy. I start making the nginx bloc configuration file using the one give in the official documentation and I add some rules to « harding nginx ». T…

---

## [TLJH exploited by bitcoin mining](https://discourse.jupyter.org/t/tljh-exploited-by-bitcoin-mining/18040)

<div class="topic-metadata">

**Author:** [@bwanamarko](https://discourse.jupyter.org/u/bwanamarko)\
**Replies:** 8\
**Last updated:** [February 21, 2023, 9:07pm UTC](https://discourse.jupyter.org/t/tljh-exploited-by-bitcoin-mining/18040 "2023-02-21T21:07:18Z")

</div>

I had to burn our TLJH instance recently, because it was exploited for Bitcoin mining by this attack. We use JupyterHub for pvlib python tutorials at various conferences and workshops big and small, and it has been used…

---

## [Security Advisory for Jupyter Core package](https://discourse.jupyter.org/t/security-advisory-for-jupyter-core-package/16527)

<div class="topic-metadata">

**Author:** [@blink1073](https://discourse.jupyter.org/u/blink1073)\
**Replies:** 0\
**Last updated:** [October 26, 2022, 7:06pm UTC](https://discourse.jupyter.org/t/security-advisory-for-jupyter-core-package/16527 "2022-10-26T19:06:32Z")

</div>

We just published a security advisory to jupyter\_core. Users are recommended to upgrade to jupyter\_core\>=4.11.2 to pick up the fix, which prevents Jupyter applications from loading configuration files from the current w…

---

## [Autohttps pod unable to obtain Lets Encrypt certificate](https://discourse.jupyter.org/t/autohttps-pod-unable-to-obtain-lets-encrypt-certificate/15141)

<div class="topic-metadata">

**Author:** [@Taylor\_Gibson](https://discourse.jupyter.org/u/Taylor_Gibson)\
**Replies:** 3\
**Last updated:** [August 2, 2022, 7:16pm UTC](https://discourse.jupyter.org/t/autohttps-pod-unable-to-obtain-lets-encrypt-certificate/15141 "2022-08-02T19:16:47Z")

</div>

I’ve been attempting to set up a new jupyterhub cluster on GCP using the Z2JH guide, and it’s been unable to obtain a certificate from Let’s Encrypt to allow for an https connection. I’ve had this working on an older ver…

---

## [Connecting to Spark Cluster with all-spark-notebook](https://discourse.jupyter.org/t/connecting-to-spark-cluster-with-all-spark-notebook/14911)

<div class="topic-metadata">

**Author:** [@ltm893](https://discourse.jupyter.org/u/ltm893)\
**Replies:** 0\
**Last updated:** [July 12, 2022, 10:55pm UTC](https://discourse.jupyter.org/t/connecting-to-spark-cluster-with-all-spark-notebook/14911 "2022-07-12T22:55:25Z")

</div>

I am trying to setup an SSL connection between a docker all-spark-notebook and Spark Cluster. I was given a .crt file. Tried putting it in here /etc/ssl/certs but dont think that worked.

---

## [Requiring 2FA for Jupyter GitHub Organizations](https://discourse.jupyter.org/t/requiring-2fa-for-jupyter-github-organizations/14836)

<div class="topic-metadata">

**Author:** [@rpwagner](https://discourse.jupyter.org/u/rpwagner)\
**Replies:** 0\
**Last updated:** [July 5, 2022, 3:18pm UTC](https://discourse.jupyter.org/t/requiring-2fa-for-jupyter-github-organizations/14836 "2022-07-05T15:18:29Z")

</div>

Requiring 2FA for Jupyter GitHub Organizations This requirement and the outlined plan was discussed and agreed upon at the Jupyter Governance meeting on Friday, July 1, 2022. This was also posted on the Jupyter Blog. By…

---

## [Read sensitive details as k8s secrets](https://discourse.jupyter.org/t/read-sensitive-details-as-k8s-secrets/13774)

<div class="topic-metadata">

**Author:** [@agelosnm](https://discourse.jupyter.org/u/agelosnm)\
**Replies:** 0\
**Last updated:** [April 7, 2022, 2:27pm UTC](https://discourse.jupyter.org/t/read-sensitive-details-as-k8s-secrets/13774 "2022-04-07T14:27:47Z")

</div>

How can one provide any desired resources in general as Kubernetes secrets from the .yaml file?

---

## [Can Jupyter Notebook/Lab have custom authentication?](https://discourse.jupyter.org/t/can-jupyter-notebook-lab-have-custom-authentication/12898)

<div class="topic-metadata">

**Author:** [@Bill\_Major](https://discourse.jupyter.org/u/Bill_Major)\
**Replies:** 0\
**Last updated:** [February 4, 2022, 7:20pm UTC](https://discourse.jupyter.org/t/can-jupyter-notebook-lab-have-custom-authentication/12898 "2022-02-04T19:20:49Z")

</div>

Hi everyone. For Jupyter Notebook or JupyterLab (and tornado), can I build my own custom authenticator? For example, in my environment, I have my own authentication service I want to integrate with. Users will have a …

---

## [IPython 8.0.1, 7.31.1, 7.16.3 security update out (CVE-2022-21699)](https://discourse.jupyter.org/t/ipython-8-0-1-7-31-1-7-16-3-security-update-out-cve-2022-21699/12654)

<div class="topic-metadata">

**Author:** [@carreau](https://discourse.jupyter.org/u/carreau)\
**Replies:** 0\
**Last updated:** [January 19, 2022, 1:48pm UTC](https://discourse.jupyter.org/t/ipython-8-0-1-7-31-1-7-16-3-security-update-out-cve-2022-21699/12654 "2022-01-19T13:48:12Z")

</div>

Outside of original schedule. 3 releases of IPython that deactivate looking for configuration in current working directory. CVE-2022-21699 Update recommended. pip install --upgrade IPython Those releases only contain…

---

## [1password team subscription for Jupyter](https://discourse.jupyter.org/t/1password-team-subscription-for-jupyter/12651)

<div class="topic-metadata">

**Author:** [@carreau](https://discourse.jupyter.org/u/carreau)\
**Replies:** 0\
**Last updated:** [January 19, 2022, 10:44am UTC](https://discourse.jupyter.org/t/1password-team-subscription-for-jupyter/12651 "2022-01-19T10:44:03Z")

</div>

Hello everyone, As the Jupyter Community is growing, it becomes challenging to manage credential and access to many services. To help in the enterprise, Jupyter now have a 1password team subscription that is gracefully…

[Next page](https://discourse.jupyter.org/tag/security/36.md?match_all_tags=true&page=1&tags%5B%5D=security)