# Jupyter Enterprise Gateway: Kubernetes Manifest Injection in Jinja2 Template Rendering

Jupyter Enterprise Gateway interpolates KERNEL_* env vars into a Jinja2 Kubernetes manifest without YAML escaping, letting an API caller inject securityContext or extra documents to spawn privileged root pods.

- Payout: Research
- Severity: critical
- Program: Jupyter Enterprise Gateway
- Found by: ben-elttam
- Disclosed: 2026-06-03
- CVE: CVE-2026-44182
- Write-up quality: 8/10
- Original: https://github.com/advisories/GHSA-cfw7-6c5v-2wjq
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-cfw7-6c5v-2wjq
- Tags: area:cloud domain:cloud domain:web impact:internal-access impact:privesc impact:rce kind:research platform:ghsa sev:critical tech:kubernetes tech:python technique:source-review vuln:command-injection

**Target:** POST /api/kernels kernel launch endpoint rendering kernel-pod.yaml.j2
**Root cause:** Untrusted KERNEL_* environment values (e.g. KERNEL_WORKING_DIR) are substituted into the Jinja2 Kubernetes manifest template without YAML-aware escaping, so quotes/newlines break out of the scalar and inject YAML keys or document separators.
**Steps:**
1. Ensure EG_MIRROR_WORKING_DIRS / mirrorWorkingDirs is enabled so KERNEL_WORKING_DIR is honored.
2. Send `POST /api/kernels` with env KERNEL_WORKING_DIR set to `"/tmp\"\n\n# INJECTION\n  securityContext:\n    runAsUser: 0\n    runAsGroup: 0\n    fsGroup: 100\n# HAHA - stray quote "`.
3. Rendered manifest contains a duplicate pod-level `securityContext` with runAsUser/runAsGroup 0; last key wins, container runs as root.
4. For multi-document injection use payload containing `...\n---\napiVersion: v1\nkind: Pod\n...` with a privileged container spec.
5. Observe `kubectl get pods -n notebooks` showing the injected-pod alongside the kernel pod.
**How found:** Reporter noted the manifest template interpolates kernel_* variables sourced from client-supplied KERNEL_* env vars and reasoned that unescaped values inside quoted YAML scalars permit quote-breakout, duplicate-key clobbering and `---`/`...` document injection.
**Exploitation:** An authenticated API caller supplies crafted KERNEL_* env vars; the gateway renders the manifest and applies it, creating attacker-controlled pods. Duplicate securityContext keys clobber the original to run as root, or multi-document YAML creates additional privileged pods with arbitrary image, volumeMounts (hostPath) and securityContext, enabling container escape and cluster compromise.
**Escalation:** Privileged pods can load kernel modules to compromise the host; hostPath R/W mounts plus root securityContext allow writing a crontab on the worker node for host code execution; repeated exploitation compromises all worker nodes and the cluster.
**Insight:** When a template renders YAML by string interpolation, test every client-controlled variable for quote/newline breakout; duplicate keys (last-wins) let you silently override securityContext without removing the original, and `...`/`---` markers turn a single-object template into arbitrary multi-resource creation.