CVE-2022-24758

The Jupyter notebook is a web-based notebook environment for interactive computing. Prior to version 6.4.9, unauthorized actors can access sensitive information from server logs. Anytime a 5xx error is triggered, the auth cookie and other header values are recorded in Jupyter server logs by default. Considering these logs do not require root access, an attacker can monitor these logs, steal sensitive auth/cookie information, and gain access to the Jupyter server. Jupyter notebook version 6.4.x contains a patch for this issue. There are currently no known workarounds.

• CWE-532

• https://github.com/jupyter/notebook/security/advisories/GHSA-m87f-39q9-6f55Third Party Advisory
• https://github.com/jupyter/notebook/security/advisories/GHSA-m87f-39q9-6f55Third Party Advisory

Published

Mar 31, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-24752SyliusGridBundle is a package of generic data grids for Symf…9.8
• CVE-2022-24753Stripe CLI is a command-line tool for the Stripe eCommerce p…7
• CVE-2022-24754PJSIP is a free and open source multimedia communication lib…9.8
• CVE-2022-24755Bareos is open source software for backup, archiving, and re…9.8
• CVE-2022-24756Bareos is open source software for backup, archiving, and re…7.5
• CVE-2022-24757The Jupyter Server provides the backend (i.e. the core servi…7.5
• CVE-2022-24759`@chainsafe/libp2p-noise` contains TypeScript implementation…7.4
• CVE-2022-2476A null pointer dereference bug was found in wavpack-5.4.0 Th…5.5
• CVE-2022-24760Parse Server is an open source http web server backend. In v…10
• CVE-2022-24761Waitress is a Web Server Gateway Interface server for Python…7.5
• CVE-2022-24762sysend.js is a library that allows a user to send messages b…6.5
• CVE-2022-24763PJSIP is a free and open source multimedia communication lib…7.5