Log in Start free

Vulnerability · Published Sep 17, 2026 · Assigned by GitHub_M

CVE-2026-86049Jupyter Server: 5xx request logging leaks token-bearing Referer header values

High 7.1

In plain English

A high-severity sensitive data in logs in jupyter_server from jupyter-server. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.1High
Exploit odds (30 days)0.4%top 63.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Jupyter Server is the backend for Jupyter web applications. Prior to version 2.21.0, the 5xx request logging path in jupyter_server/log.py copies the Referer header into a JSON header block without applying the token scrubbing used for the request URI. A request that returns HTTP 500 while the Referer contains a token-bearing URL can therefore write that token to server logs in plaintext. An attacker who can read those logs can recover the token and use the affected user's Jupyter Server permissions. This issue is fixed in version 2.21.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12jupyter-serverno fix listedDEBIAN-CVE-2026-86049
Debian:13jupyter-serverno fix listedDEBIAN-CVE-2026-86049
Debian:14jupyter-serverno fix listedDEBIAN-CVE-2026-86049
PyPIjupyter-server2.21.0GHSA-c3mw-737p-c7g2
PyPIjupyter-server2.21.0PYSEC-2026-4054
Ubuntu:22.04:LTSjupyter-serverno fix listedUBUNTU-CVE-2026-86049
Ubuntu:24.04:LTSjupyter-serverno fix listedUBUNTU-CVE-2026-86049
Ubuntu:26.04:LTSjupyter-serverno fix listedUBUNTU-CVE-2026-86049
Ubuntu:26.10jupyter-serverno fix listedUBUNTU-CVE-2026-86049

Affected products (as reported)

VendorProductVersions
jupyter-server jupyter_server < 2.21.0

Weakness: CWE-532 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

References