vetkit.jupyter.server.no-authentication
The Jupyter server is configured with an empty token and no password. Anyone who can reach it gets an unauthenticated notebook, i.e. arbitrary code execution as the server user.
Last updated:
Suite: Security
regex
The Jupyter server is configured with an empty token and no password. Anyone who can reach it gets an unauthenticated notebook, i.e. arbitrary code execution as the server user.
Category: SECURITY · Engine rule severity: ERROR
How to fix it
Keep token authentication (the default) or set a hashed password, and bind the server to 127.0.0.1 behind an authenticating proxy when it must be shared.
References
Source: packages/engine/rules/sast/config.yml.
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.