CVE-2026-44180
CVE-2026-44180 is a critical input validation flaw in Jupyter Enterprise Gateway versions 2.0.0rc1 through 3.2.x that allows attackers to bypass the default prohibition on running kernels as root (UID/GID 0). By supplying a specially crafted KERNEL_UID or KERNEL_GID value, an attacker can launch Jupyter kernels with root privileges, potentially leading to container escapes, compromise of worker nodes, and full cluster takeover. The issue is resolved in version 3.0.0.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Jupyter Enterprise Gateway
Real-world impact
Attackers can gain root access inside containers, escape to the host, and compromise the entire Kubernetes cluster.
Why this severity
CVSS 9.8 (Critical) due to network‑adjacent, low‑complexity attack requiring no privileges or user interaction, with high impact on confidentiality, integrity, and availability.
What to do about it
- 01Upgrade Jupyter Enterprise Gateway to version 3.0.0 or later.
Fix information comes from the NVD description which states the issue has been fixed in version 3.0.0.