Jupyter Server: 5xx request logging leaks token-bearing Referer header values

SummaryWhen a request returns a 500, jupyterserver/log.py logs a small JSON block of request headers. The Referer header was copied into it as-is, so a token in the Referer URL ended up in the logs in plain text. ImpactAnyone who can read the server logs can pick tokens out of these 500 entries...

CVE-2026-86049: Insertion of Sensitive Information into Log File

Jupyter Server is the backend for Jupyter web applications. Prior to version 2.21.0, the 5xx request logging path in jupyterserver/log.py copies the Referer header into a JSON header block without applying the token scrubbing used for the request URI. A request that returns HTTP 500 while the...