GPU VulnDB

Database/AI/ML frameworks & serving

Jupyter Enterprise Gateway: KERNEL_UID/GID validation bypass lets kernels run as root

CVSS 9.8CVE-2026-44180AI/ML frameworks & servingcurated

Impact

The feature that refuses to launch kernels with UID or GID 0 can be bypassed with a crafted KERNEL_UID or KERNEL_GID value, so a kernel container runs as root. Combined with the ability to specify volume mounts, the advisory describes a container escape: a read-write hostPath mount plus root in the container is enough to write a crontab onto the worker node and get code execution there. On a GPU fleet that means the attacker owns the node and every workload sharing its GPUs, and repeating it across nodes compromises the cluster. This is an input-validation bypass, separate from the template and YAML injection issues in the same release.

Who can reach it

Anyone able to submit a kernel start request to Enterprise Gateway with attacker-chosen KERNEL_UID/KERNEL_GID; the CVSS vector states no privileges required.

What to do

Upgrade to 3.3.0 (the release that carries the fix) and restart the gateway service - no node drain needed for the patch itself, but any node you believe was escaped to must be treated as compromised and rebuilt, which does mean draining it. Meanwhile, enforce non-root and block hostPath at the admission-control layer rather than relying on the gateway's own UID check.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-44180https://github.com/jupyter-server/enterprise_gateway/security/advisories/GHSA-chq7-94j8-cj28https://github.com/jupyter-server/enterprise_gateway/releases/tag/v3.3.0

Related entries

All AI/ML frameworks & serving entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.