Jupyter Server: 5xx request logging leaks token-bearing Referer header values

Summary When a request returns a 500, jupyterserver/log.py logs a small JSON block of request headers. The Referer header was copied into it as-is, so a token in the Referer URL ended up in the logs in plain text. Impact Anyone who can read the server logs can pick tokens out of these 500 entries...

CVE-2026-86049

Jupyter Server (the backend for Jupyter web applications) prior to version 2.21.0 contains a token-leak flaw in the 5xx request logging path within jupyter_server/log.py. The Referer header is copied into a JSON header block without applying the same token scrubbing used for the request URI. When...

EUVD-2026-82436

Jupyter Server is the backend for Jupyter web applications. Prior to version 2.21.0, the 5xx request logging path in jupyterserver/log.py copies the Referer header into a JSON header block without applying the token scrubbing used for the request URI. A request that returns HTTP 500 while the...