CVE-2026-44182

Received Received - Intake

YAML Injection in Jupyter Enterprise Gateway

Publication date: 2026-07-16

Last updated on: 2026-07-16

Assigner: GitHub, Inc.

Description

Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark, Kubernetes, and Docker Swarm. In versions prior to 3.3.0, the server interpolates untrusted environment variables (e.g., KERNEL_XXX) into Kubernetes manifests without YAML-aware escaping, enabling YAML injection attacks. Attackers can inject new fields, overwrite critical fields (e.g., duplicate securityContext keys, where the last one prevails), and inject document boundaries (--- for new documents, ... for end-of-document) to generate multiple resources, potentially creating arbitrary types, such as privileged pods. The Jinja2 template for the Kubernetes manifest contains several kernel_xxx variables, such as kernel_working_dir that are used when rendering the manifest and are all vectors for YAML injection. This issue has been fixed in version 3.3.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-16

Last Modified

2026-07-16

Generated

2026-07-17

AI Q&A

2026-07-17

EPSS Evaluated

N/A

NVD

CVE-2026-44182

Affected Vendors & Products

Vendor	Product	Version / Range
jupyter	jupyter_enterprise_gateway	to 3.3.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-74	The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

Jupyter Enterprise Gateway versions before 3.3.0 are vulnerable to YAML injection due to improper handling of untrusted environment variables like KERNEL_XXX. These variables are interpolated directly into Kubernetes manifests without proper escaping, allowing attackers to inject malicious YAML content. This can lead to overwriting critical fields, creating duplicate keys, or generating multiple resources, potentially resulting in the creation of privileged pods.

Detection Guidance

Check if Jupyter Enterprise Gateway versions prior to 3.3.0 are installed. Inspect Kubernetes manifests for YAML injection patterns like duplicate keys, document boundaries (--- or ...), or unexpected fields in environment variables such as KERNEL_XXX. Monitor for unauthorized pod creation or privilege escalation events in your cluster.

Impact Analysis

If exploited, this vulnerability could allow attackers to execute arbitrary code or gain unauthorized access to your Kubernetes cluster by creating privileged pods. This could lead to data breaches, unauthorized data access, or disruption of services running on the cluster. The impact is severe due to the potential for full system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's data protection requirements and HIPAA's security and privacy rules. Organizations may face legal penalties, reputational damage, and loss of trust due to non-compliance with these regulations.

Mitigation Strategies

Upgrade Jupyter Enterprise Gateway to version 3.3.0 or later immediately. Review and sanitize environment variables passed to kernel manifests. Implement strict input validation for all KERNEL_XXX variables. Restrict pod creation permissions and audit existing manifests for signs of exploitation.

Hi! I’m here to help you understand CVE-2026-44182. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70