https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T10:50:24.167240+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2020-26261 CVE-2020-26261 — user-readable api tokens in systemd units 2026-10-09T10:50:24.200102+00:00

Affected: jupyterhub systemdspawner

jupyterhub-systemdspawner enables JupyterHub to spawn single-user notebook servers using systemd. In jupyterhub-systemdspawner before version 0.15 user API tokens issued to single-user servers are specified in the environment of systemd units. These tokens are incorrectly accessible to all users. In particular, the-littlest-jupyterhub is affected, which uses systemdspawner by default. This is patched in jupyterhub-systemdspawner v0.15

 https://cve.radiocsirt.org/vuln/ghsa-cg54-gpgr-4rm6 GHSA-cg54-gpgr-4rm6 — user-readable api tokens in systemd units for JupyterHub 2026-10-09T10:50:24.200165+00:00

Affected: PyPI: jupyterhub-systemdspawner

### Impact user API tokens issued to single-user servers are specified in the environment of systemd units, which are accessible to all users.

In particular, the-littlest-jupyterhub is affected, which uses systemdspawner by default.

### Patches Patched in jupyterhub-systemdspawner v0.15

### Workarounds No workaround other than upgrading systemdspawner to 0.15

### For more information

If you have any questions or comments about this advisory: * Open a thread in [the Jupyter forum](https://discourse.jupyter.org) * Email us at [security@ipython.org](mailto:security@ipython.org)