Jupyter Server Vulnerability in Referer Header Logging

CVE-2026-86049

What is CVE-2026-86049?

The vulnerability in Jupyter Server pertains to an improper handling of the Referer header during request logging. Before version 2.21.0, the application failed to sanitize sensitive token information from the Referer header when logging requests that resulted in HTTP 500 errors. This oversight led to the potential exposure of token-bearing URLs in plaintext within server logs. Consequently, an unauthorized individual with access to these logs could leverage this information to exploit the permissions associated with the affected user's Jupyter Server account. Users are advised to update to version 2.21.0 or later to mitigate this vulnerability.

References