Jupyter server Token bruteforcing

Answer in brief

CVE-2022-29241 records a High severity (CVSS 7.1) vulnerability in Jupyter server Token bruteforcing. The current sources do not mark it as known exploited. The current feed maps jupyter-server (pypi), jupyter-server (pypi). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Jun 16, 2022Updated Sep 10, 2026Source checked Sep 10, 2026First seen by HOL Aug 7, 2026Material review Sep 10, 2026

Upstream Advisory

Key facts

Risk: High · CVSS 7.1
Exploitation: Not marked as known exploited
Affected software: 2 mapped packages or products
Fix availability: Available

Why this deserves its current priority

CVSS is 7.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps jupyter-server (pypi), jupyter-server (pypi). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
jupyter-serverpypi	>=0 <1.17.1	1.17.1
jupyter-serverpypi	>=2.0.0a0 <2.0.0a1	2.0.0a1

Recommended response

Check inventory. Check lockfiles and deployed manifests for jupyter-server, jupyter-server.
Review the reported fix. Update jupyter-server to 1.17.1; jupyter-server to 2.0.0a1 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Jun 16, 2022
Evidence: source:osv:source_dates:source-dates:record
Source modified
Sep 10, 2026
Evidence: source:osv:source_dates:source-dates:record
First seen by HOL
Aug 7, 2026

Sources and claim methodology

Upstream source description

Affects: Notebook and Lab between 6.4.0?(potentially earlier) and 6.4.11 (currently latest). Jupyter Server <=1.16.0. If I am correct about the responsible code it will affect Jupyter-Server 1.17.0 and 2.0.0a0 as well. Description: If notebook server is started with a value of `root_dir` that contains the starting user's home directory, then the underlying REST API can be used to leak the access token assigned at start time by guessing/brute forcing the PID of the jupyter server. While this requires an authenticated user session, this url can be used from an xss payload (as in CVE-2021-32798) or from a hooked or otherwise compromised browser to leak this access token to a malicious third party. This token can be used along with the REST API to interact with Jupyter services/notebooks such as modifying or overwriting critical files, such as .bashrc or .ssh/authorized_keys, allowing a malicious user to read potentially sensitive data and possibly gain control of the impacted system.

Quoted source text, attributed separately from HOL analysis.