https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T08:30:58.517342+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2024-avi-1103 certfr-2024-avi-1103 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-09T08:30:58.521172+00:00 certfr-2024-avi-1103 https://cve.radiocsirt.org/vuln/euvd-2026-46018 EUVD-2026-46018 2026-10-09T08:30:58.521223+00:00 EUVD-2026-46018 https://cve.radiocsirt.org/vuln/fkie_cve-2020-26261 fkie_cve-2020-26261 2026-10-09T08:30:58.521252+00:00

jupyterhub-systemdspawner enables JupyterHub to spawn single-user notebook servers using systemd. In jupyterhub-systemdspawner before version 0.15 user API tokens issued to single-user servers are specified in the environment of systemd units. These tokens are incorrectly accessible to all users. In particular, the-littlest-jupyterhub is affected, which uses systemdspawner by default. This is patched in jupyterhub-systemdspawner v0.15

 https://cve.radiocsirt.org/vuln/ghsa-cg54-gpgr-4rm6 GHSA-cg54-gpgr-4rm6 — user-readable api tokens in systemd units for JupyterHub 2026-10-09T08:30:58.521322+00:00

Affected: PyPI: jupyterhub-systemdspawner

### Impact user API tokens issued to single-user servers are specified in the environment of systemd units, which are accessible to all users.

In particular, the-littlest-jupyterhub is affected, which uses systemdspawner by default.

### Patches Patched in jupyterhub-systemdspawner v0.15

### Workarounds No workaround other than upgrading systemdspawner to 0.15

### For more information

If you have any questions or comments about this advisory: * Open a thread in [the Jupyter forum](https://discourse.jupyter.org) * Email us at [security@ipython.org](mailto:security@ipython.org)

 https://cve.radiocsirt.org/vuln/gsd-2020-26261 gsd-2020-26261 2026-10-09T08:30:58.521352+00:00 gsd-2020-26261 https://cve.radiocsirt.org/vuln/pysec-2020-52 PYSEC-2020-52 2026-10-09T08:30:58.521365+00:00

Affected: PyPI: jupyterhub-systemdspawner

jupyterhub-systemdspawner enables JupyterHub to spawn single-user notebook servers using systemd. In jupyterhub-systemdspawner before version 0.15 user API tokens issued to single-user servers are specified in the environment of systemd units. These tokens are incorrectly accessible to all users. In particular, the-littlest-jupyterhub is affected, which uses systemdspawner by default. This is patched in jupyterhub-systemdspawner v0.15