CVE-2026-44182 is a critical YAML injection (CVSS 10.0) in Jupyter Enterprise Gateway versions up to 3.2.3. Untrusted kernel environment variables are placed into Kubernetes manifests without escaping, which can add resources such as privileged pods. Upgrade to 3.3.0 or later without delay.
What's affected
From the project advisory for the jupyter_enterprise_gateway PyPI package:
- Affected: 3.2.3 and earlier.
- Fixed: 3.3.0.
It applies to deployments that launch kernels as Kubernetes pods. It is a sibling of CVE-2026-44181, a template injection in the same code path. Both are fixed in 3.3.0, so one upgrade closes both.
How to check if you're exposed
Check the installed version where the gateway runs:
pip show jupyter_enterprise_gateway
For container deployments, read the image tag from the Deployment, then confirm that the Kubernetes process proxy is in use. If kernels start as pods in your cluster, treat the deployment as in scope.
What to do now
- Upgrade to Jupyter Enterprise Gateway 3.3.0 or later.
- Restrict network access to the gateway so only trusted notebook clients can send kernel start requests.
- Audit pods created by the gateway for unusual security context settings, extra resources, or privileged mode.
- Reduce the gateway service account to the permissions that kernel launching needs.
Why it matters
The record uses CWE-74 (injection into a downstream component). The manifest template inserts values such as the working directory straight into YAML. YAML has its own syntax for new keys, repeated keys and document boundaries, and the advisory notes that when a key is repeated the last one wins. That lets crafted input replace a safe security setting with a permissive one, or start a second document that defines a different resource.
The fix class is to build structured data in code and serialize it, instead of pasting strings into a text template. The record does not mark this CVE as KEV, and the advisory does not report exploitation.
Quick check
Is this the same bug as CVE-2026-44181?
No. Both are injection flaws in the manifest rendering, but one uses template syntax and this one uses YAML syntax. The same release fixes both.
Sources
Last reviewed: 19 October 2026.
