CVE-2026-86049: Jupyter Server: 5xx request logging leaks token-bearing Referer header values
When a request returns a 500, jupyter_server/log.py logs a small JSON block of request headers.
The Referer header was copied into it as-is, so a token in the Referer URL ended up in the logs in plain text.
References
- github.com/advisories/GHSA-c3mw-737p-c7g2
- github.com/jupyter-server/jupyter_server/commit/52513529af7096e622c00911b17627b266294717
- github.com/jupyter-server/jupyter_server/pull/1681
- github.com/jupyter-server/jupyter_server/releases/tag/v2.21.0
- github.com/jupyter-server/jupyter_server/security/advisories/GHSA-c3mw-737p-c7g2
- nvd.nist.gov/vuln/detail/CVE-2026-86049
Code Behaviors & Features
Detect and mitigate CVE-2026-86049 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →