CVE-2022-24757: Jupyter Server Unauthorized Access to Sensitive Information
Summary
CVE-2022-24757: The Jupyter Server provides the backend (i.e. Affects jupyter-server across 2 version ranges.
< 1.15.4
< a5683aca0b0e412672ac6218d09f74d44ca0de5a
Fixed in a5683aca0b0e412672ac6218d09f74d44ca0de5a. How to fix ↓
Also tracked for
- jupyter-server · Debian:11
The same CVE-2022-24757 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jupyter Server is a backend service that provides core functionalities, APIs, and REST endpoints for Jupyter web applications. It is widely used for interactive computing and data science workflows. Jupyter Server allows users to create and share documents containing live code, equations, visualizations, and narrative text. It supports various programming languages and provides a web-based interface for easy access and collaboration. However, prior to version 1.15.4, Jupyter Server is vulnerable to unauthorized access to sensitive information from server logs.
Vulnerability Detail
The vulnerability in Jupyter Server allows unauthorized actors to access sensitive information from server logs. When a 5xx error occurs, the server logs record the authentication cookie and other header values by default. These logs can be accessed without requiring root access, enabling an attacker to monitor the logs and steal sensitive authentication and cookie information. By exploiting this vulnerability, an attacker can gain unauthorized access to the Jupyter server and potentially compromise the system. Jupyter Server version 1.15.4 contains a patch to address this issue.
How To Fix
Latest published version: 2.21.1 as of 23 Oct 2026
pip install --upgrade "jupyter-server==2.21.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
a5683aca0b0e412672ac6218d09f74d44ca0de5a
This is the first release that contains the fix.
pip install --upgrade "jupyter-server==a5683aca0b0e412672ac6218d09f74d44ca0de5a"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability in Jupyter Server allows unauthorized access to sensitive information from server logs, potentially leading to unauthorized access to the server and system compromise. It is crucial to upgrade Jupyter Server to version 1.15.4 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for jupyter-server →
FAQ
Jupyter Server is a backend service that provides core functionalities, APIs, and REST endpoints for Jupyter web applications. It enables users to create and share interactive documents containing live code, visualizations, and narrative text.
The vulnerability allows unauthorized actors to access sensitive information from server logs, including authentication cookies. This can lead to unauthorized access to the Jupyter server and potential compromise of the system.
You can check the version of Jupyter Server by running the command 'jupyter server --version' in your terminal or command prompt.
Currently, there are no known workarounds for this vulnerability. It is recommended to upgrade to Jupyter Server version 1.15.4 or later.
You can find more information about this vulnerability in the official Jupyter Server advisory database. The link to the specific advisory for this vulnerability is provided in the 'affected' section of this report.
References
Related vulnerabilities
Recent vulnerabilities recorded for jupyter-server.
