CVE-2026-86049: Jupyter Server: 5xx request logging leaks token-bearing Referer header values
Summary
When a request returns a 500, jupyterserver/log.py logs a small JSON block of request headers.
The Referer header was copied into it as-is, so a token in the Referer URL ended up in the logs in plain text.
Impact
Anyone who can read the server logs can pick tokens out of these 500 entries. Tokens end up in the Referer during normal token-based login and launch flows.
Affected: all versions before 2.21.0.
PoC
Any malformed request that returns a 500 works:
bash curl -i -X POST \ -H 'Content-Type: application/json' \ -H 'Referer: http://127.0.0.1:8899/tree?token=REFERTOKEN' \ --data '{"name":123}' \ 'http://127.0.0.1:8899/api/kernels?token=VALIDTOKEN'
The log shows the token twice, once raw and once redacted:
"Referer": "http://127.0.0.1:8899/tree?token=REFERTOKEN", [E ... ServerApp] 500 POST /api/kernels?token=[secret] (...) referer=http://127.0.0.1:8899/tree?token=[secret]
Patches
Fixed in 2.21.0 by 5251352. Header values are now scrubbed before the block is logged. Upgrade to 2.21.0 or later.
Workarounds
Limit who can read the server logs. If you can, avoid flows that put the token in the URL.
Other sources
Jupyter Server is the backend for Jupyter web applications. Prior to version 2.21.0, the 5xx request logging path in jupyterserver/log.py copies the Referer header into a JSON header block without applying the token scrubbing used for the request URI. A request that returns HTTP 500 while the Referer contains a token-bearing URL can therefore write that token to server logs in plaintext. An attacker who can read those logs can recover the token and use the affected user's Jupyter Server permissions. This issue is fixed in version 2.21.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/jupyter_serverto a version that resolves this vulnerability.Fixed in 2.21.0 - Upgrade
Upgrade
jupyter_serverto a version that resolves this vulnerability.Fixed in 2.21.0Patch 5251352 - Configuration
Avoid flows that put the token in the URL (token-bearing Referer URLs), since the Referer header can contain the token and was logged in plaintext for HTTP 500 responses prior to 2.21.0.
Jupyter Server (token handling via URL) Avoid token-bearing URLs in the Referer = true/when possible - Compensating control
Limit who can read the Jupyter Server logs, since token-bearing Referer header values are written to logs for HTTP 5xx responses prior to 2.21.0.
Event History
Frequently Asked Questions
Who can exploit the leaked token?
An attacker must be able to read the Jupyter Server logs containing the affected 5xx request entry. They can recover a plaintext token from a token-bearing Referer value and use the permissions of the user associated with that token.
What conditions are required for token exposure?
A request must return HTTP 500, and its Referer header must contain a token-bearing URL. The vulnerable 5xx logging path records that Referer in a JSON header block without token scrubbing.
Which versions are affected and what fixes the issue?
Jupyter Server versions prior to 2.21.0 are affected. Upgrade to version 2.21.0 to obtain the fix.