Jupyter Server: 5xx request logging leaks token-bearing Referer header values
Summary
When a request returns a 500, jupyter_server/log.py logs a small JSON block of request headers.
The Referer header was copied into it as-is, so a token in the Referer URL ended up in the logs in plain text.
Impact
Anyone who can read the server logs can pick tokens out of these 500 entries. Tokens end up in the Referer during normal token-based login and launch flows.
Affected: all versions before 2.21.0.
PoC
Any malformed request that returns a 500 works:
curl -i -X POST \
-H 'Content-Type: application/json' \
-H 'Referer: http://127.0.0.1:8899/tree?token=REFERTOKEN' \
--data '{"name":123}' \
'http://127.0.0.1:8899/api/kernels?token=VALIDTOKEN'The log shows the token twice, once raw and once redacted:
"Referer": "http://127.0.0.1:8899/tree?token=REFERTOKEN",
[E ... ServerApp] 500 POST /api/kernels?token=[secret] (...) referer=http://127.0.0.1:8899/tree?token=[secret]Patches
Fixed in 2.21.0 by 5251352. Header values are now scrubbed before the block is logged. Upgrade to 2.21.0 or later.
Workarounds
Limit who can read the server logs. If you can, avoid flows that put the token in the URL.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Python (PyPI) | jupyter-server | < 2.21.0 | 2.21.0 |
Referencias
- https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-c3mw-737p-c7g2
- https://github.com/jupyter-server/jupyter_server/pull/1681
- https://github.com/jupyter-server/jupyter_server/commit/52513529af7096e622c00911b17627b266294717
- https://github.com/jupyter-server/jupyter_server
- https://github.com/jupyter-server/jupyter_server/releases/tag/v2.21.0
- https://pypi.org/project/jupyter-server
- https://github.com/advisories/GHSA-c3mw-737p-c7g2
- https://nvd.nist.gov/vuln/detail/CVE-2026-86049
- Vector CVSS
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H- Debilidad (CWE)
CWE-532- Plataforma
- Python (PyPI)
- Paquete
jupyter-server- Publicada
- 17.09.2026
- Actualizado
- 11.10.2026 15:18
Fuentes y licencias
OSV / GitHub Advisory Database - PYSEC-2026-4054 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-c3mw-737p-c7g2 - CC BY 4.0
Historial de vulnerabilidades: jupyter-server
Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 14
- Primera → última
- 11.2020 09.2026
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Crítica 1
- Alta 7
- Media 6
Divulgaciones por año
- 2020: 2
- 2021: 0
- 2022: 2
- 2023: 3
- 2024: 1
- 2025: 0
- 2026: 6
-
Jupyter Server: 5xx request logging leaks token-bearing Referer header values esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.