{"id":"CVE-2026-86049","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-86049","summary":"Jupyter Server: 5xx request logging leaks token-bearing Referer header values","details":"### Summary\n\nWhen a request returns a 500, `jupyter_server/log.py` logs a small JSON block of request headers. \n\nThe Referer header was copied into it as-is, so a token in the Referer URL ended up in the logs in plain text.\n\n### Impact\n\nAnyone who can read the server logs can pick tokens out of these 500 entries. Tokens end up in the Referer during normal token-based login and launch flows.\n\nAffected: all versions before 2.21.0.\n\n### PoC\n\nAny malformed request that returns a 500 works:\n\n```bash\ncurl -i -X POST \\\n  -H 'Content-Type: application/json' \\\n  -H 'Referer: http://127.0.0.1:8899/tree?token=REFERTOKEN' \\\n  --data '{\"name\":123}' \\\n  'http://127.0.0.1:8899/api/kernels?token=VALIDTOKEN'\n```\n\nThe log shows the token twice, once raw and once redacted:\n\n```\n\"Referer\": \"http://127.0.0.1:8899/tree?token=REFERTOKEN\",\n[E ... ServerApp] 500 POST /api/kernels?token=[secret] (...) referer=http://127.0.0.1:8899/tree?token=[secret]\n```\n\n### Patches\n\nFixed in 2.21.0 by 5251352. Header values are now scrubbed before the block is logged. Upgrade to 2.21.0 or later.\n\n### Workarounds\n\nLimit who can read the server logs. If you can, avoid flows that put the token in the URL.","published":"2026-09-17T20:28:55Z","modified":"2026-09-17T20:45:05.014441361Z","cvss":{"score":7.1,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"PyPI","name":"jupyter-server","fixedVersion":"2.21.0"}],"fix":{"url":"https://github.com/jupyter-server/jupyter_server/pull/1681","label":"jupyter-server/jupyter_server#1681"},"references":[{"type":"WEB","url":"https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-c3mw-737p-c7g2"},{"type":"WEB","url":"https://github.com/jupyter-server/jupyter_server/pull/1681"},{"type":"WEB","url":"https://github.com/jupyter-server/jupyter_server/commit/52513529af7096e622c00911b17627b266294717"},{"type":"PACKAGE","url":"https://github.com/jupyter-server/jupyter_server"},{"type":"WEB","url":"https://github.com/jupyter-server/jupyter_server/releases/tag/v2.21.0"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-17T20:45:05.014441361Z"}}