orca.securityadvisoryOrca Security: Critical Jupyter Enterprise Gateway Vulnerabilities
Orca Security discloses three critical unauthenticated vulnerabilities in Jupyter Enterprise Gateway's Kubernetes manifest rendering pipeline: CVE-2026-44182 (YAML injection via unsanitized environment variables allowing creation of privileged pods/secrets), CVE-2026-44181 (Server-Side Template Injection via KERNEL_XXX env vars in the Jinja2 rendering path, enabling arbitrary Python/OS code execution), and CVE-2026-44180 (bypass of the _enforce_prohibited_ids control that blocks UID/GID 0 kernels, enabling container escape). All affect versions before 3.3.0 and can lead to full Kubernetes cluster compromise in multi-tenant or internet-facing deployments.
TL;DR Three critical unauthenticated CVEs (CVSS up to 10.0) in Jupyter Enterprise Gateway's Jinja2-based K8s manifest rendering allow YAML injection, SSTI, and privileged-pod creation leading to full cluster compromise.
CVEs named here
- CVE-2026-44182
- CVE-2026-44181
- CVE-2026-44180
Technologies named here
- Jupyter Enterprise Gateway
- Orca Security Platform
- Jinja2
- Kubernetes
- Orca Security
Techniques named here
- YAML injection
- Server-Side Template Injection
- Security control bypass
- Kubernetes service account token theft
Related in Cloud & Infra
orca.securityarticleOrca Security: GenAI Risks in Cloud Environments
.png)
aikido.devwriteupGoogle API keys keep working after you delete them
attackthesoc.comarticle