CVE-2026-86049

Jupyter Server (the backend for Jupyter web applications) prior to version 2.21.0 contains a token-leak flaw in the 5xx request logging path within jupyter_server/log.py. The Referer header is copied into a JSON header block without applying the same token scrubbing used for the request URI. When...