Summary
A high-severity authorization bypass in Jupyter Server can allow an authenticated but restricted user to execute code through an upstream kernel channel when GatewayClient.url is enabled. The issue becomes risky when kernel execution is intended to be denied by the configured authorizer, but the active WebSocket handler does not enforce that decision.
A high-severity authorization bypass in Jupyter Server can allow an authenticated but restricted user to execute code through an upstream kernel channel when GatewayClient.url is enabled. The issue becomes risky when kernel execution is intended to be denied by the configured authorizer, but the active WebSocket handler does not enforce that decision.
Affected context
The vulnerability affects Jupyter Server deployments using the gateway client and kernel WebSocket channel handlers. In affected configurations, the gateway-specific handler authenticates the user but may omit the authorization check for the execute action on kernel resources. Deployments that manually register the deprecated jupyter_server.gateway.handlers module may remain exposed because that handler can retain the same authorization gap.
The vulnerability affects Jupyter Server deployments using the gateway client and kernel WebSocket channel handlers. In affected configurations, the gateway-specific handler authenticates the user but may omit the authorization check for the execute action on kernel resources. Deployments that manually register the deprecated jupyter_server.gateway.handlers module may remain exposed because that handler can retain the same authorization gap.
Exploit preconditions
- Attack surface: Jupyter Server kernel WebSocket or upstream gateway channel
- Required access: An authenticated account with access to the Jupyter application but without permission to execute code on the targeted kernel
- Trigger point: Opening or using a kernel channel through the gateway-enabled handler
- Why exploitation is possible: Authentication is performed, but the configured authorizer's decision for the kernel execute action is not consistently enforced
- Attack surface: Jupyter Server kernel WebSocket or upstream gateway channel
- Required access: An authenticated account with access to the Jupyter application but without permission to execute code on the targeted kernel
- Trigger point: Opening or using a kernel channel through the gateway-enabled handler
- Why exploitation is possible: Authentication is performed, but the configured authorizer's decision for the kernel execute action is not consistently enforced
Why this happens
The underlying bug is an authorization enforcement failure mapped to CWE-862: Missing Authorization. A gateway-specific WebSocket handler replaced the normal kernel handler but validated identity without invoking the configured authorization decision for kernel execution. This creates a gap between authentication and authorization, allowing a user who is recognized by the system to perform an action that policy intended to restrict.
The underlying bug is an authorization enforcement failure mapped to CWE-862: Missing Authorization. A gateway-specific WebSocket handler replaced the normal kernel handler but validated identity without invoking the configured authorization decision for kernel execution. This creates a gap between authentication and authorization, allowing a user who is recognized by the system to perform an action that policy intended to restrict.
Potential impact
- A restricted user may execute code in an accessible kernel
- Kernel-resident data, tokens, credentials, or environment information could be exposed
- The kernel environment could be modified or disrupted
- Connected data sources or services may be affected according to the kernel's privileges
- A compromised kernel may provide a path toward broader impact where excessive permissions exist
- A restricted user may execute code in an accessible kernel
- Kernel-resident data, tokens, credentials, or environment information could be exposed
- The kernel environment could be modified or disrupted
- Connected data sources or services may be affected according to the kernel's privileges
- A compromised kernel may provide a path toward broader impact where excessive permissions exist
General mitigation guidance
Mitigation generally focuses on ensuring that every kernel execution path
consistently applies authorization decisions after authentication.
Common defensive patterns include:
- Use handlers that explicitly enforce the configured authorization policy for kernel execute actions
- Avoid manually registering deprecated gateway handler modules
- Apply authorization checks at the resource-action boundary rather than relying only on connection authentication
- Use least-privilege identities for Jupyter services, kernels, and gateway components
- Limit kernel access to only the users, projects, and resources that require it
- Treat kernel channels as privileged execution interfaces and isolate them accordingly
- Add regression tests covering denied execute actions through every supported WebSocket and gateway route
Mitigation generally focuses on ensuring that every kernel execution path
consistently applies authorization decisions after authentication.
Common defensive patterns include:
- Use handlers that explicitly enforce the configured authorization policy for kernel execute actions
- Avoid manually registering deprecated gateway handler modules
- Apply authorization checks at the resource-action boundary rather than relying only on connection authentication
- Use least-privilege identities for Jupyter services, kernels, and gateway components
- Limit kernel access to only the users, projects, and resources that require it
- Treat kernel channels as privileged execution interfaces and isolate them accordingly
- Add regression tests covering denied execute actions through every supported WebSocket and gateway route
How teams detect issues like this
Organizations can assess this issue through:
- Static and configuration analysis for manual registration of deprecated gateway handlers
- Code review checks verifying that kernel WebSocket handlers invoke authorization for execute actions
- Integration tests using authenticated users whose kernel execution permission is explicitly denied
- Runtime policy reviews comparing gateway routes, handler registrations, and authorizer rules
- Monitoring for restricted users establishing kernel channels or performing unexpected execution activity
- Automated security review tools that identify authentication paths lacking corresponding authorization checks
Organizations can assess this issue through:
- Static and configuration analysis for manual registration of deprecated gateway handlers
- Code review checks verifying that kernel WebSocket handlers invoke authorization for execute actions
- Integration tests using authenticated users whose kernel execution permission is explicitly denied
- Runtime policy reviews comparing gateway routes, handler registrations, and authorizer rules
- Monitoring for restricted users establishing kernel channels or performing unexpected execution activity
- Automated security review tools that identify authentication paths lacking corresponding authorization checks
