What’s Vulnerable › Vulnerabilities

CVE-2020-26261: user-readable api tokens in systemd units

• Severity: high (CVSS 7.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-12-09 · updated 2026-06-17
• Weakness: CWE-668

Description

jupyterhub-systemdspawner enables JupyterHub to spawn single-user notebook servers using systemd. In jupyterhub-systemdspawner before version 0.15 user API tokens issued to single-user servers are specified in the environment of systemd units. These tokens are incorrectly accessible to all users. In particular, the-littlest-jupyterhub is affected, which uses systemdspawner by default. This is patched in jupyterhub-systemdspawner v0.15

Affected products

• jupyterhub systemdspawner: before 0.15 — fixed in 0.15

How to fix

Upgrade to a fixed version: jupyterhub systemdspawner 0.15. Check the vendor advisory for mitigations.

References

• https://github.com/jupyterhub/systemdspawner/blob/master/CHANGELOG.md#v015
• https://github.com/jupyterhub/systemdspawner/commit/a4d08fd2ade1cfd0ef2c29dc221e649345f23580
• https://github.com/jupyterhub/systemdspawner/security/advisories/GHSA-cg54-gpgr-4rm6
• https://pypi.org/project/jupyterhub-systemdspawner/
• https://github.com/jupyterhub/systemdspawner/blob/master/CHANGELOG.md#v015
• https://github.com/jupyterhub/systemdspawner/commit/a4d08fd2ade1cfd0ef2c29dc221e649345f23580
• https://github.com/jupyterhub/systemdspawner/security/advisories/GHSA-cg54-gpgr-4rm6
• https://pypi.org/project/jupyterhub-systemdspawner/

Get alerted when CVE-2020-26261 or the next vulnerability affects your stack