Jupyter Enterprise Gateway renders Kubernetes manifests from untrusted environment variables without YAML‑aware escaping. In versions prior to 3.3.0, the server interpolates untrusted environment variables such as KERNEL_XXX into Jinja2 templates used to generate the manifests. Attackers can inject new fields, overwrite existing keys, and duplicate critical fields like securityContext, with the last instance taking precedence. They can also add document boundaries (--- and ...), creating multiple YAML resources—including privileged pods and other arbitrary types. All kernel_xxx variables in the template, for example kernel_working_dir, are potential vectors for these injections.

Jupyter Enterprise Gateway deploys remote Jupyter Notebook kernels across distributed clusters such as Apache Spark, Kubernetes, and Docker Swarm. All releases before 3.3.0 are affected due to the unescaped Jinja2 template rendering.

The CVSS score of 10 marks this as a critical flaw, while the EPSS score of < 1% indicates that exploitation is currently rare. It is not listed in the CISA KEV catalog. The likely attack vector involves an attacker supplying untrusted environment variables through the gateway’s exposed interfaces or configuration mechanisms, causing the server to inject malicious content into the manifest that the Kubernetes API then processes. Successful exploitation can create privileged pods or otherwise manipulate cluster resources.