CVE-2026-54338

mediumCVSS 5.3covered by 2 sourcesfirst seen 2026-08-07

Impact Invalid input to login resulted in unbounded logging output. Only form-based Authenticators (the default PAM Authenticator, but not the more widely used OAuthenticator) are affected. Patches Upgrade to 5.5.0. Workarounds Use an Authenticator that doesn't use a login form, such as OAuthenticator.

⚡ Watch CVE-2026-54338

Get an email if CVE-2026-54338 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.28% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 20% of all EPSS-scored CVEs.

Advisory coverage (2)

mediumGHSA-p43p-whwx-q52h: JupyterHub has Unauthenticated Denial of Service via Unbounded Username Logging on Failed…ghsa · 2026-08-25
mediumCVE-2026-54338: JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. …nvd · 2026-08-07

External references

NVD record for CVE-2026-54338

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-54338 status](https://www.csirts.com/badge/CVE-2026-54338)](https://www.csirts.com/cve/CVE-2026-54338)