Jupyter Server: 5xx request logging leaks token-bearing Referer header values

Summary When a request returns a 500, jupyterserver/log.py logs a small JSON block of request headers. The Referer header was copied into it as-is, so a token in the Referer URL ended up in the logs in plain text. Impact Anyone who can read the server logs can pick tokens out of these 500 entries...

Insertion of Sensitive Information into Log File

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the logrequest function in jupyterserver/log.py, which logs the full Referer header value without sanitization. When a request causes a 500 error, the Referer header - which may conta...

GHSA-C3MW-737P-C7G2 Jupyter Server: 5xx request logging leaks token-bearing Referer header values

Summary When a request returns a 500, jupyterserver/log.py logs a small JSON block of request headers. The Referer header was copied into it as-is, so a token in the Referer URL ended up in the logs in plain text. Impact Anyone who can read the server logs can pick tokens out of these 500 entries...

CVE-2026-86049 Jupyter Server: 5xx request logging leaks token-bearing Referer header values

Jupyter Server is the backend for Jupyter web applications. Prior to version 2.21.0, the 5xx request logging path in jupyterserver/log.py copies the Referer header into a JSON header block without applying the token scrubbing used for the request URI. A request that returns HTTP 500 while the...

CVE-2026-86049

Jupyter Server (the backend for Jupyter web applications) prior to version 2.21.0 contains a token-leak flaw in the 5xx request logging path within jupyter_server/log.py. The Referer header is copied into a JSON header block without applying the same token scrubbing used for the request URI. When...

EUVD-2026-82436

Jupyter Server is the backend for Jupyter web applications. Prior to version 2.21.0, the 5xx request logging path in jupyterserver/log.py copies the Referer header into a JSON header block without applying the token scrubbing used for the request URI. A request that returns HTTP 500 while the...

CVE-2026-86049

Jupyter Server is the backend for Jupyter web applications. Prior to version 2.21.0, the 5xx request logging path in jupyterserver/log.py copies the Referer header into a JSON header block without applying the token scrubbing used for the request URI. A request that returns HTTP 500 while the...

CVE-2026-86049 Jupyter Server: 5xx request logging leaks token-bearing Referer header values

Jupyter Server is the backend for Jupyter web applications. Prior to version 2.21.0, the 5xx request logging path in jupyterserver/log.py copies the Referer header into a JSON header block without applying the token scrubbing used for the request URI. A request that returns HTTP 500 while the...

CVE-2026-86049 Jupyter Server: 5xx request logging leaks token-bearing Referer header values

Jupyter Server is the backend for Jupyter web applications. Prior to version 2.21.0, the 5xx request logging path in jupyterserver/log.py copies the Referer header into a JSON header block without applying the token scrubbing used for the request URI. A request that returns HTTP 500 while the...

Grav: Origin validation bypass in Uri::referrer() and Pages::referrerRoute() via unanchored prefix match

Summary Grav\Common\Uri::referrer and Grav\Common\Page\Pages::referrerRoute both check whether an incoming request's Referer header "came from our site" using strstartswith$referrer, $base, where $base is the site's own absolute root URL for example https://example.com, no trailing slash. Because...

EUVD-2026-65216

Grav: Origin validation bypass in Uri::referrer and Pages::referrerRoute via unanchored prefix match...

GHSA-9CCQ-2JFG-QW33 Grav: Origin validation bypass in Uri::referrer() and Pages::referrerRoute() via unanchored prefix match

Summary Grav\Common\Uri::referrer and Grav\Common\Page\Pages::referrerRoute both check whether an incoming request's Referer header "came from our site" using strstartswith$referrer, $base, where $base is the site's own absolute root URL for example https://example.com, no trailing slash. Because...

PT-2026-95109

Name of the Vulnerable Software and Affected Versions Jupyter Server versions prior to 2.21.0 Description In the 5xx request logging path within jupyter server/log.py, the Referer header is copied into a JSON header block without applying the token scrubbing typically used for the request URI. Wh...

CVE-2026-86049: Insertion of Sensitive Information into Log File

Jupyter Server is the backend for Jupyter web applications. Prior to version 2.21.0, the 5xx request logging path in jupyterserver/log.py copies the Referer header into a JSON header block without applying the token scrubbing used for the request URI. A request that returns HTTP 500 while the...

Astra Linux – Vulnerability in curl

curl 7.1.1 up to and including 7.75.0 is vulnerable to a “Exposure of Private Personal Information to an Unauthorized Actor” by leaking credentials in the HTTP Referer: header. libcurl does not remove user credentials from the URL when automatically filling in the Referer: HTTP request header fie...

EUVD-2026-76740

A file-upload handler redirects the authenticated client's browser to a URL taken directly from that same request's Referer header, without validating it against the application's own origin. This allows an authenticated attacker to craft a request that causes another user's browser to be...

CVE-2026-90453

A file-upload handler redirects the authenticated client's browser to a URL taken directly from that same request's Referer header, without validating it against the application's own origin. This allows an authenticated attacker to craft a request that causes another user's browser to be...

CVE-2026-90453 Open Redirect in Malcolm

A file-upload handler redirects the authenticated client's browser to a URL taken directly from that same request's Referer header, without validating it against the application's own origin. This allows an authenticated attacker to craft a request that causes another user's browser to be...

CVE-2026-90453 Open Redirect in Malcolm

A file-upload handler redirects the authenticated client's browser to a URL taken directly from that same request's Referer header, without validating it against the application's own origin. This allows an authenticated attacker to craft a request that causes another user's browser to be...

CVE-2026-90453 Open Redirect in Malcolm

A file-upload handler redirects the authenticated client's browser to a URL taken directly from that same request's Referer header, without validating it against the application's own origin. This allows an authenticated attacker to craft a request that causes another user's browser to be...