Is CVE-2021-39159 actively exploited?

No active exploitation of CVE-2021-39159 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2021-39159 be exploited remotely?

Yes. CVE-2021-39159 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2021-39159?

CVE-2021-39159 has a CVSS score of 9.8 (CRITICAL).

HOME VULNERABILITIESCVE-2021-39159

CRITICAL

CVE-2021-39159

CWE-94Published: August 25, 2021· Updated: Jun 17, 2026

9.8

CVSS v3.1

Official Description

BinderHub is a kubernetes-based cloud service that allows users to share reproducible interactive computing environments from code repositories. In affected versions a remote code execution vulnerability has been identified in BinderHub, where providing BinderHub with maliciously crafted input could execute code in the BinderHub context, with the potential to egress credentials of the BinderHub deployment, including JupyterHub API tokens, kubernetes service accounts, and docker registry credentials. This may provide the ability to manipulate images and other user created pods in the deployment, with the potential to escalate to the host depending on the underlying kubernetes configuration. Users are advised to update to version 0.2.0-n653. If users are unable to update they may disable the git repo provider by specifying the `BinderHub.repo_providers` as a workaround.

NVD Source

Technical Analysis

CVE-2021-39159 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 9.8.