PT-2026-3268 · Unknown · Dask.Distributed+2

Jacobtomlinson · Published 2026-01-01 · Updated 2026-03-12 · CVE-2026-23528

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Dask distributed versions prior to 2026.1.0

Description When Jupyter Lab, jupyter-server-proxy, and Dask distributed are used together, a crafted URL can lead to code execution by Jupyter due to a cross-site scripting (XSS) issue in the Dask dashboard. An attacker could create a phishing URL assuming Jupyter Lab and Dask are running on localhost with default ports. Clicking this link opens an error page in the Dask Dashboard through the Jupyter Lab proxy, causing code execution by the default Jupyter Python kernel. The vulnerability occurs when a malicious URL is used to execute JavaScript in the user's browser within the Dask dashboard.

Recommendations Versions prior to 2026.1.0 should be upgraded to version 2026.1.0 or later. As a mitigation, uninstall jupyter-server-proxy and access the Dask dashboard directly via its URL. As a mitigation, ensure both Jupyter and the Dask dashboard are running on non-standard ports.

Exploit

Fix

RCE

XSS

Weakness Enumeration

CWE-80

CWE-79

CWE-250

Related Identifiers

CVE-2026-23528

GHSA-C336-7962-WFJ2

PYSEC-2026-169

Affected Products

Dask.Distributed

Jupyterlab

Jupyter Server Proxy

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23528.json · Exploit
• https://github.com/dask/distributed/commit/ab72092a8a938923c2bb51a2cd14ca26614827fa · Patch
• https://github.com/dask/distributed/security/advisories/GHSA-c336-7962-wfj2 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-23528 · Security Note
• https://ubuntu.com/security/CVE-2026-23528 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-169 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23528 · Security Note
• https://osv.dev/vulnerability/GHSA-c336-7962-wfj2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-23528 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-23528 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-23528 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-23528 · Vendor Advisory
• https://github.com/dask/distributed · Note
• https://t.me/cveNotify/155334 · Telegram Post
• https://twitter.com/CVEnew/status/2012303239555989737 · Twitter Post