Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2025-32428
CVE-2025-32428:
Python vulnerability analysis and mitigation
Overview
Jupyter Remote Desktop Proxy, a tool that enables running Linux Desktop environments on JupyterHub, contains a critical security vulnerability (CVE-2025-32428) discovered in April 2025. The vulnerability affects version 3.0.0 when used with TigerVNC, where the VNC server remains accessible via the network despite being configured to use UNIX sockets for user-level isolation. This issue was assigned a CVSSv4 score of 9.0 (Critical) (NVD, SecurityOnline).
Technical details
The vulnerability stems from a configuration issue where jupyter-remote-desktop-proxy version 3.0.0, when used with TigerVNC as the VNC server executable, inadvertently exposes VNC services over the network instead of limiting access to local UNIX sockets. The system was designed to rely exclusively on UNIX domain sockets for communication to provide user-level isolation, but TigerVNC opens a TCP network port, bypassing the intended security measures. Notably, this vulnerability does not affect systems using TurboVNC, which correctly honors the UNIX socket configuration (GitHub Advisory).
Impact
In shared environments such as universities or cloud-hosted Jupyter platforms, this vulnerability could allow attackers on the same network to connect to and interact with another user's Linux desktop session without proper authentication. This access could potentially lead to unauthorized data access, session hijacking, or privilege abuse (SecurityOnline).
Mitigation and workarounds
The vulnerability has been patched in jupyter-remote-desktop-proxy version 3.0.1. Users are strongly advised to upgrade to this version. Alternatively, users can switch to TurboVNC as their VNC server executable, as it is not affected by this vulnerability (NVD, GitHub Advisory).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management