Jupyter Enterprise Gateway, which manages remote Jupyter Notebook kernels on distributed clusters, has an improper input validation vulnerability (CWE-20) in versions 2.0.0rc1 and later but before 3.3.0. The product includes a feature that prohibits launching kernels with UID or GID 0 (root) by default. However, this restriction can be bypassed by supplying specially crafted KERNEL_UID or KERNEL_GID values, allowing kernels to run as root. This elevated privilege can lead to container escapes, for example by leveraging writable hostPath volume mounts to create crontab entries on the host, thereby compromising the underlying worker node and potentially the entire Kubernetes cluster. The issue is resolved starting from version 3.0.0.

Exploitation of this vulnerability allows attackers to run Jupyter kernels as root, significantly increasing the attack surface. This can lead to container escapes and full compromise of the worker node hosting the kernel. Since worker nodes are part of distributed clusters like Kubernetes, repeated exploitation can compromise all worker nodes and the entire cluster, resulting in complete loss of confidentiality, integrity, and availability of workloads running on the cluster.

A fix is available in Jupyter Enterprise Gateway version 3.0.0. Users should upgrade to version 3.0.0 or later to remediate this vulnerability. No other official remediation or temporary fixes are indicated. Until upgrading, avoid configurations that allow setting KERNEL_UID or KERNEL_GID to bypass restrictions, and restrict use of writable hostPath volume mounts to minimize container escape vectors.