CVE-2020-26261: 
Python vulnerability analysis and mitigation

CVE-2020-26261 affects jupyterhub-systemdspawner, a tool that enables JupyterHub to spawn single-user notebook servers using systemd. The vulnerability was discovered and disclosed on December 9, 2020, affecting all versions prior to 0.15. The issue involves user API tokens issued to single-user servers being incorrectly accessible to all users through systemd unit environments. This particularly impacts the-littlest-jupyterhub installation, which uses systemdspawner by default (GitHub Advisory).

The vulnerability is classified with a CVSS v3.1 Base Score of 7.9 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. It is categorized under CWE-668 (Exposure of Resource to Wrong Sphere). The issue stems from the way environment variables containing API tokens were passed to systemd units, making them readable by all users on the system (NVD).

The vulnerability allows unauthorized access to user API tokens, which could lead to potential compromise of user sessions and data. Since these tokens are accessible to all users on the system, it creates a significant security risk where users could potentially access and manipulate other users' notebook servers (GitHub Advisory).

The vulnerability requires local access to the system and user interaction. An attacker would need to have a local account on the system to exploit this vulnerability. The attack complexity is considered low, but privileged access is required (NVD).

The vulnerability was patched in jupyterhub-systemdspawner version 0.15, which implements the use of EnvironmentFile to pass environment variables to systemd units securely. Users are strongly advised to upgrade to version 0.15 or later, as there are no other workarounds available (GitHub Changelog).