CVE-2026-86049
Jupyter Server: 5xx request logging leaks token-bearing Referer header values
CVSS Score
7.1
EPSS Score
0.0%
EPSS Percentile
0th
Jupyter Server is the backend for Jupyter web applications. Prior to version 2.21.0, the 5xx request logging path in jupyter_server/log.py copies the Referer header into a JSON header block without applying the token scrubbing used for the request URI. A request that returns HTTP 500 while the Referer contains a token-bearing URL can therefore write that token to server logs in plaintext. An attacker who can read those logs can recover the token and use the affected user's Jupyter Server permissions. This issue is fixed in version 2.21.0.
| CWE | CWE-532 |
| Vendor | jupyter-server |
| Product | jupyter_server |
| Published | Sep 17, 2026 |
Stay Ahead of the Next One
Get instant alerts for jupyter-server jupyter_server
Be the first to know when new high vulnerabilities affecting jupyter-server jupyter_server are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
jupyter-server / jupyter_server
< 2.21.0
References
github.com: https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-c3mw-737p-c7g2 github.com: https://github.com/jupyter-server/jupyter_server/pull/1681 github.com: https://github.com/jupyter-server/jupyter_server/commit/52513529af7096e622c00911b17627b266294717 github.com: https://github.com/jupyter-server/jupyter_server/releases/tag/v2.21.0