CVE-2020-26261

jupyterhub-systemdspawner enables JupyterHub to spawn single-user notebook servers using systemd. In jupyterhub-systemdspawner before version 0.15 user API tokens issued to single-user servers are specified in the environment of systemd units. These tokens are incorrectly accessible to all users. In particular, the-littlest-jupyterhub is affected, which uses systemdspawner by default. This is patched in jupyterhub-systemdspawner v0.15

• CWE-668
• CWE-668

• https://github.com/jupyterhub/systemdspawner/blob/master/CHANGELOG.md#v015Release Notes, Third Party Advisory
• https://github.com/jupyterhub/systemdspawner/commit/a4d08fd2ade1cfd0ef2c29dc221e649345f23580Patch, Third Party Advisory
• https://github.com/jupyterhub/systemdspawner/security/advisories/GHSA-cg54-gpgr-4rm6Third Party Advisory
• https://pypi.org/project/jupyterhub-systemdspawner/Product, Third Party Advisory
• https://github.com/jupyterhub/systemdspawner/blob/master/CHANGELOG.md#v015Release Notes, Third Party Advisory
• https://github.com/jupyterhub/systemdspawner/commit/a4d08fd2ade1cfd0ef2c29dc221e649345f23580Patch, Third Party Advisory
• https://github.com/jupyterhub/systemdspawner/security/advisories/GHSA-cg54-gpgr-4rm6Third Party Advisory
• https://pypi.org/project/jupyterhub-systemdspawner/Product, Third Party Advisory

Published

Dec 9, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-26256Fast-csv is an npm package for parsing and formatting CSVs o…6.5
• CVE-2020-26257Matrix is an ecosystem for open federated Instant Messaging …6.5
• CVE-2020-26258XStream is a Java library to serialize objects to XML and ba…7.7
• CVE-2020-26259XStream is a Java library to serialize objects to XML and ba…6.8
• CVE-2020-2626Vulnerability in the Enterprise Manager Base Platform produc…6
• CVE-2020-26260BookStack is a platform for storing and organising informati…6.4
• CVE-2020-26262Coturn is free open source implementation of TURN and STUN S…7.2
• CVE-2020-26263tlslite-ng is an open source python library that implements …7.5
• CVE-2020-26264Go Ethereum, or "Geth", is the official Golang implementatio…6.5
• CVE-2020-26265Go Ethereum, or "Geth", is the official Golang implementatio…5.3
• CVE-2020-26266In affected versions of TensorFlow under certain cases a sav…5.3
• CVE-2020-26267In affected versions of TensorFlow the tf.raw_ops.DataFormat…7.8