← Vulnerability feed

Vulnerability record · CVE-2022-24757 · published 23 March 2022

CVE-2022-24757: Jupyter server sensitive information in log file vulnerability

Jupyter · Jupyter Server

The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications. Prior to version 1.15.4, unauthorized actors can access sensitive information from server logs. Anytime a 5xx error is triggered, the auth cookie and other header values are recorded in Jupyter Server logs by default. Considering these logs do not require root access, an attacker can monitor these logs, steal sensitive auth/cookie information, and gain access to the Jupyter server. Jupyter Server version 1.15.4 contains a patch for this issue. There are currently no known workarounds.

7.5 CVSS 3.1 High EPSS 1.3% · top 31.4% CWE-532 · Sensitive information in log file
7.5CVSS 3.1 base score, v2 5.0
1.3%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications. Prior to version 1.15.4, unauthorized actors can access sensitive information from server logs. Anytime a 5xx error is triggered, the auth cookie and other header values are recorded in Jupyter Server logs by default. Considering these logs do not require root access, an attacker can monitor these logs, steal sensitive auth/cookie information, and gain access to the Jupyter server. Jupyter Server version 1.15.4 contains a patch for this issue. There are currently no known workarounds.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/jupyter-server/jupyter_server/commit/a5683aca0b0e412672ac6218d09f74d44ca0de5a PatchThird Party Advisory
https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-p737-p57g-4cpr Third Party Advisory
https://github.com/jupyter-server/jupyter_server/commit/a5683aca0b0e412672ac6218d09f74d44ca0de5a PatchThird Party Advisory
https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-p737-p57g-4cpr Third Party Advisory

Track CVE-2022-24757 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.3CVE-2026-44727Jupyter server cross-site scripting vulnerabilityJupyter Server is the backend for Jupyter web applications. Prior to 2.20, the nbconvert HTTP handlers in jupyter_server render user-authored noteboo…EPSS 0.44%8.8CVE-2026-6657Jupyter server origin validation error vulnerabilityA vulnerability in jupyter-server versions 1.12.0 through 2.17.0 allows an attacker to bypass CORS origin validation when the `allow_origin_pat` conf…EPSS 0.27%8.8CVE-2022-29241Jupyter server information exposure vulnerabilityJupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications like Jupyter Notebook. Prior to v…EPSS 0.95%8.1CVE-2026-5422Jupyter server relative path traversal vulnerabilityA path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check in the _get_os_path() functi…EPSS 0.55%7.6CVE-2026-40110Jupyter server vulnerabilityJupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the Origin header validation uses Python's re.match() to …EPSS 0.47%7.6CVE-2026-40934Jupyter server insufficient session expiration vulnerabilityJupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the secret used to sign authentication cookies is persist…EPSS 0.38%7.6CVE-2026-35397Jupyter server path traversal vulnerabilityJupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, a path traversal vulnerability in the REST API allows an …EPSS 0.67%7.5CVE-2024-35178Jupyter server information exposure vulnerabilityThe Jupyter Server provides the backend for Jupyter web applications. Jupyter Server on Windows has a vulnerability that lets unauthenticated attacke…EPSS 0.71%

Source: NIST National Vulnerability Database (record CVE-2022-24757), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.