10

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44182

CVE-2026-44182: Jupyter Enterprise Gateway: Kubernetes Manifest Injection in Jinja2 Template Rendering

Summary

The environment variables used during the rendering of the Kubernetes manifest allow YAML injection, enabling attackers to overwrite existing keys like securityContext and inject multi-document YAML to create additional unintended Kubernetes resources.

Details

The server interpolates untrusted environment variables (e.g., KERNEL_XXX) into Kubernetes manifests without YAML-aware escaping, enabling YAML injection attacks. Attackers can inject new fields, overwrite critical fields (e.g., duplicate securityContext keys, where the last one prevails), and inject document boundaries (--- for new documents, ... for end-of-document) to generate multiple resources, potentially creating arbitrary kinds like privileged pods.

The Jinja2 template for the Kubernetes manifest contains several kernel_xxx variables, such as kernel_working_dir that are used when rendering the manifest and are all vectors for YAML injection. https://github.com/jupyter-server/enterprise_gateway/blob/152c20f162f2fab700c04c8830ebf8c1e2e2217a/etc/kernel-launchers/kubernetes/scripts/kernel-pod.yaml.j2#L77

These values come from the environment passed in the API call, where they were KERNEL_XXX before being converted to lowercase.

https://github.com/jupyter-server/enterprise_gateway/blob/152c20f162f2fab700c04c8830ebf8c1e2e2217a/etc/kernel-launchers/kubernetes/scripts/launch_kubernetes.py#L130-L137

PoC

These proof of concepts are injecting in the KERNEL_WORKING_DIR env var, but any of the env vars could have been used. By default, the KERNEL_WORKING_DIR will be ignored unless EG_MIRROR_WORKING_DIRS is truthy for the enterprise-gateway. This is controlled by the mirrorWorkingDirs value in the Helm chart.

Using ducaale/xh:

xh http://localhost:31529/api/kernels env:=@env-working-dir-exploit.yaml

env-working-dir-exploit.yaml:

Miggo Vulnerability Database

→

CVE-2026-44182

CVE-2026-44182:

10

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
jupyter_enterprise_gateway	pip	< 3.3.0	3.3.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The root cause of the vulnerability is the insecure deserialization of untrusted data. The launch_kubernetes_kernel and launch_custom_resource_kernel functions in their respective launcher scripts read environment variables prefixed with KERNEL_ and use yaml.safe_load() on their values. This function is intended to parse YAML, but it was being used on all KERNEL_* variables, even those expected to be simple strings (e.g., KERNEL_IMAGE, KERNEL_WORKING_DIR). An attacker can craft a string that, when parsed by yaml.safe_load(), creates complex YAML structures. This payload is delivered via the /api/kernels REST endpoint, handled by MainKernelHandler.post, which sets the environment variables for the launcher scripts. The injected YAML structures are then rendered into the final Kubernetes manifest, allowing the attacker to overwrite security settings (e.g., run as root) or inject new documents to create arbitrary, privileged Kubernetes resources, leading to a full cluster compromise. The fix involves three layers: restricting yaml.safe_load() to only variables that are expected to be structured YAML, applying a yaml_safe Jinja2 filter to escape all template variables, and adding post-render validation to ensure only expected resources are created.

Vulnerable functions

launch_kubernetes_kernel

etc/kernel-launchers/kubernetes/scripts/launch_kubernetes.py

This function reads environment variables prefixed with `KERNEL_` and processes their values using `yaml.safe_load()`. This function does not distinguish between variables that should contain simple strings and those that might contain structured data. By passing a malicious string with YAML syntax (e.g., newlines, quotes, document separators) as an environment variable's value, an attacker can inject arbitrary YAML structures into the Kubernetes pod manifest that is generated later. This allows for overwriting security contexts to gain root privileges or creating entirely new, malicious Kubernetes resources.

launch_custom_resource_kernel

etc/kernel-launchers/operators/scripts/launch_custom_resource.py

This function exhibits the same vulnerability as `launch_kubernetes_kernel` but in the context of launching custom resources, such as SparkApplications. It insecurely uses `yaml.safe_load()` on environment variables prefixed with `KERNEL_`, allowing an attacker to inject malicious YAML into the custom resource definition, leading to similar impacts like privilege escalation or unauthorized resource creation.

MainKernelHandler.post

enterprise_gateway/services/kernels/handlers.py

This function is the API endpoint that receives the request to start a new kernel. It processes the `env` dictionary from the request body, which an attacker controls. The values from this dictionary are set as environment variables for the launcher script (`launch_kubernetes.py` or `launch_custom_resource.py`). This function is the entry point for the malicious payload, as it takes the attacker-controlled string and places it into the environment variable that the downstream `launch_*_kernel` functions will insecurely parse. The patch added input validation to ensure the provided value is a string and within a defined length.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

# This file defines the Kubernetes objects necessary for kernels to run witihin Kubernetes. # Substitution parameters are processed by the launch_kubernetes.py code located in the # same directory. Some values are factory values, while others (typically prefixed with 'kernel_') can be # provided by the client. # # This file can be customized as needed. No changes are required to launch_kubernetes.py provided kernel_ # values are used - which be automatically set from corresponding KERNEL_ env values. Updates will be required # to launch_kubernetes.py if new document sections (i.e., new k8s 'kind' objects) are introduced. # apiVersion: v1 kind: Pod metadata: name: "working-dir-root" namespace: "notebooks" labels: kernel_id: "186f4ecf-bf90-40b8-b210-a0987bfce927" app: enterprise-gateway component: kernel source: kernel-pod.yaml annotations: cluster-autoscaler.kubernetes.io/safe-to-evict: "false" spec: restartPolicy: Never serviceAccountName: "default" # NOTE: that using runAsGroup requires that feature-gate RunAsGroup be enabled. # WARNING: Only using runAsUser w/o runAsGroup or NOT enabling the RunAsGroup feature-gate # will result in the new kernel pod's effective group of 0 (root)! although the user will # correspond to the runAsUser value. As a result, BOTH should be uncommented AND the feature-gate # should be enabled to ensure expected behavior. In addition, 'fsGroup: 100' is recommended so # that /home/jovyan can be written to via the 'users' group (gid: 100) irrespective of the # "kernel_uid" and "kernel_gid" values. securityContext: runAsUser: 1000 runAsGroup: 100 fsGroup: 100 containers: - image: "elyra/kernel-py:3.2.3" name: "working-dir-root" env: # Add any custom envs here that aren't already configured for the kernel's environment # - name: MY_CUSTOM_ENV # value: "my_custom_value" workingDir: "/tmp" # INJECTION securityContext: runAsUser: 0 runAsGroup: 0 fsGroup: 100 # HAHA - stray quote " volumeMounts: # Define any "unconditional" mounts here, followed by "conditional" mounts that vary per client volumes: # Define any "unconditional" volumes here, followed by "conditional" volumes that vary per client

10

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-44182: Jupyter Enterprise Gateway: Kubernetes Manifest Injection in Jinja2 Template Rendering

Summary

Details

PoC

CVE-2026-44182:

10

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Detect and Respond To Threats Faster.

10

10

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

CVE-2026-44182: Jupyter Enterprise Gateway: Kubernetes Manifest Injection in Jinja2 Template Rendering

Summary

Details

PoC

Injecting a Pod

Impact

10

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-44182: Jupyter Enterprise Gateway: Kubernetes Manifest Injection in Jinja2 Template Rendering

Summary

Details

PoC

CVE-2026-44182:

10

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

10

10

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

CVE-2026-44182: Jupyter Enterprise Gateway: Kubernetes Manifest Injection in Jinja2 Template Rendering

Summary

Details

PoC

Injecting a Pod

Impact

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI