CVE-2026-86049— Jupyter Server: 5xx request logging leaks token-bearing Referer header values
Quick assessment
Affected
jupyter-server jupyter_server
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Jupyter Server 是 Jupyter Web 应用的后端。在 2.21.0 版本之前， 中针对 5xx 请求的日志记录逻辑会将 请求头原样复制到 JSON 日志块中，但未对 应用与请求 URI 相同的令牌清理（token scrubbing）处理。因此，当一个请求返回 HTTP 500 错误，且其 中包含携带令牌的 URL 时，该令牌可能会以明文形式写入服务器日志。能够读取这些日志的攻击者可以恢复该令牌，并借此获取受影响用户的 Jupyter Server 权限。此问题已在 2.21.0 版本中修复。
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| jupyter-server | jupyter_server | < 2.21.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-86049
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Jupyter Server: 5xx request logging leaks token-bearing Referer header values
Source: CVE Program / CVE List V5
Vulnerability Description
Jupyter Server is the backend for Jupyter web applications. Prior to version 2.21.0, the 5xx request logging path in jupyter_server/log.py copies the Referer header into a JSON header block without applying the token scrubbing used for the request URI. A request that returns HTTP 500 while the Referer contains a token-bearing URL can therefore write that token to server logs in plaintext. An attacker who can read those logs can recover the token and use the affected user's Jupyter Server permissions. This issue is fixed in version 2.21.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
通过日志文件的信息暴露
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| jupyter-server | jupyter_server | < 2.21.0 | - |
|
II. Public POCs for CVE-2026-86049
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-86049
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-86049 (2)
Vendor Advisories for CVE-2026-86049 (1)
Vendor Pages for CVE-2026-86049 (1)
-
🔗 Release v2.21.0 · jupyter-server/jupyter_server · GitHub x_refsource_MISC
IV. Related Vulnerabilities
Same product: jupyter_server
-
CVE-2026-44727
Jupyter Server: Stored XSS in `NbconvertFileHandler` / `Nbco -
CVE-2026-40934
jupyter-server authentication cookies remain valid after pas -
CVE-2026-40110
jupyter-server CORS origin validation bypass via unanchored -
CVE-2026-35397
jupyter-server path traversal allows access to sibling direc -
CVE-2025-61669
jupyter_server next parameter open redirect can redirect use
Same vendor: jupyter-server
-
CVE-2026-44182
Jupyter Enterprise Gateway Has Kubernetes Manifest Injection -
CVE-2026-44181
Jupyter Enterprise Gateway: Jinja2 Template Server Side Temp -
CVE-2026-44180
Jupyter Enterprise Gateway: ContainerProcessProxy._enforce_p -
CVE-2026-44727
Jupyter Server: Stored XSS in `NbconvertFileHandler` / `Nbco -
CVE-2026-40934
jupyter-server authentication cookies remain valid after pas
Same weakness: CWE-532
-
CVE-2026-92758
Logs may collect sensitive information -
CVE-2026-82723
Actor record with password digest stored in AshAuthenticatio -
CVE-2026-92918
admin3 through 3.0.0 Session Token Disclosure via Audit Log -
CVE-2026-73457
Under certain circumstances, the gNPSI client credentials mi -
CVE-2026-73442
On affected platforms running Arista EOS with VRRP enabled,
V. Comments for CVE-2026-86049
No comments yet