Dask distributed is a distributed task scheduler for Dask. Prior to 2026.1.0, when Jupyter Lab, jupyter-server-proxy, and Dask distributed are all run together, it is possible to craft a URL which will result in code being executed by Jupyter due to a cross-side-scripting (XSS) bug in the Dask dashboard. It is possible for attackers to craft a phishing URL that assumes Jupyter Lab and Dask may be running on localhost and using default ports. If a user clicks on the malicious link it will open an error page in the Dask Dashboard via the Jupyter Lab proxy which will cause code to be executed by the default Jupyter Python kernel. This vulnerability is fixed in 2026.1.0.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Dask distributed is a distributed task scheduler for Dask. Prior to 2026.1.0, when Jupyter Lab, jupyter-     server-proxy, and Dask distributed are all run together, it is possible to craft a URL which will result     in code being executed by Jupyter due to a cross-side-scripting (XSS) bug in the Dask dashboard. It is     possible for attackers to craft a phishing URL that assumes Jupyter Lab and Dask may be running on     localhost and using default ports. If a user clicks on the malicious link it will open an error page in     the Dask Dashboard via the Jupyter Lab proxy which will cause code to be executed by the default Jupyter     Python kernel. This vulnerability is fixed in 2026.1.0. (CVE-2026-23528)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Dask distributed is a distributed task scheduler for Dask. Prior to 2026.1.0, when Jupyter Lab, jupyter-
    server-proxy, and Dask distributed are all run together, it is possible to craft a URL which will result
    in code being executed by Jupyter due to a cross-side-scripting (XSS) bug in the Dask dashboard. It is
    possible for attackers to craft a phishing URL that assumes Jupyter Lab and Dask may be running on
    localhost and using default ports. If a user clicks on the malicious link it will open an error page in
    the Dask Dashboard via the Jupyter Lab proxy which will cause code to be executed by the default Jupyter
    Python kernel. This vulnerability is fixed in 2026.1.0. (CVE-2026-23528)

ID	Name	Product	Family	Type	Severity
291276	Linux Distros Unpatched Vulnerability : CVE-2026-23528	Nessus	Misc.	Local	medium
436800	SCA: security update for distributed (GHSA-c336-7962-wfj2)	Tenable Cloud Security	SCA Checks	Local	medium
436800	SCA: security update for distributed (GHSA-c336-7962-wfj2)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-23528

medium

Tenable Plugins

medium

medium

medium