Jupyter Enterprise Gateway: Jinja2 template injection in KERNEL_* env vars gives RCE in the gateway

Impact

The KERNEL_XXX environment variables a client supplies when requesting a kernel are rendered through Jinja2 into the Kubernetes pod manifest without sanitization, so template expressions execute Python and shell commands inside the Enterprise Gateway service itself. The gateway holds a Kubernetes service account token with the rights to create kernel pods, so the attacker can read cluster secrets and schedule a privileged pod or a pod with a hostPath mount - that is full control of the cluster and of every GPU node in it. On a shared GPU cluster where Enterprise Gateway is the front door for notebook users, this turns a notebook request into cluster-admin. The advisory describes the request path as unauthenticated.

Who can reach it

Anyone who can reach the Enterprise Gateway HTTP endpoint and submit a kernel start request; the CVSS vector and the advisory indicate no authentication is required. If the gateway is only reachable from a tenant network, any tenant on that network qualifies.

What to do

Upgrade Enterprise Gateway to 3.3.0 and restart the gateway service; running kernels are unaffected but in-flight sessions drop. No node reboot or GPU downtime is needed. Until the upgrade, restrict network access to the gateway and treat the gateway service account token as potentially exposed - rotate it and audit for pods created outside the normal kernel pattern.

References

Related entries

• Jupyter Enterprise Gateway: YAML injection in kernel env vars creates arbitrary Kubernetes resourcesCVE-2026-44182 · Jupyter Enterprise Gateway (Kubernetes manifest YAML escaping)Critical
• ChromaDB: Pre-authentication code injectionCVE-2026-45829 · ChromaDBCritical
• Kubeflow Pipelines frontend: unauthenticated SSRF proxy reaches cloud metadata and cluster-internal APIsCVE-2026-54745 · Kubeflow Pipelines frontend (/_proxy/ route in proxy-middleware.ts)Critical
• Crawl4AI: request-supplied Chromium switches give command execution in the crawler containerCVE-2026-57572 · Crawl4AI Docker API server (browser_config.extra_args passed to Chromium launch arguments)Critical
• ruflo: unauthenticated MCP bridge exposes terminal_execute, yielding a shell and provider API keysCVE-2026-59726 · ruflo MCP bridge (unauthenticated POST /mcp and /mcp/:group in the default docker-compose deployment)Critical
• Xinference: unauthenticated chat request reaches eval() in the Llama3 tool-call parserCVE-2026-61539 · Xinference (Llama3 tool-call parser, `_eval_llama3_chat_arguments`)Critical