CVE-2026-44182

Name of the Vulnerable Software and Affected Versions Jupyter Enterprise Gateway versions prior to 3.3.0

Description The server interpolates untrusted environment variables into Kubernetes manifests without YAML-aware escaping, enabling YAML injection attacks. Attackers can inject new fields, overwrite critical fields such as securityContext keys, and use document boundaries to generate multiple resources, including privileged pods. The Jinja2 template for the Kubernetes manifest uses several kernel xxx variables, such as kernel working dir, which serve as vectors for this injection. These values are derived from environment variables (e.g., KERNEL XXX) passed via the /api/kernels endpoint. This issue has been reported as exploited and can lead to full cluster compromise by allowing the creation of arbitrary Kubernetes resources like Pod, Secret, PersistentVolumeClaim, PersistentVolume, Service, and ConfigMap, potentially enabling container escape to the underlying worker nodes.

Recommendations Update Jupyter Enterprise Gateway to version 3.3.0 or later. As a temporary mitigation, restrict access to the /api/kernels endpoint to trusted users only.