CVE-2026-86049: jupyter_server Token Leak via Referer Header in 500 Logs
Jupyter Server logged the raw Referer header on every 500 error, so any token embedded in that URL ended up in plain text inside the server log file.
The problem
In jupyter_server <= 2.20.0, the error-logging path in log.py emits a JSON block of request headers whenever a request returns HTTP 500. The Referer header was written as-is, bypassing the token-scrubbing logic that already protected the request URI line.
Tokens appear in the Referer URL during normal token-based login and JupyterHub launch flows. Any user or process that can read the server log file can extract a valid token and impersonate the affected user.
Proof of concept
A working proof-of-concept for CVE-2026-86049 in jupyter_server, with the exact payload below.
curl -i -X POST \
-H 'Content-Type: application/json' \
-H 'Referer: http://127.0.0.1:8899/tree?token=REFERTOKEN' \
--data '{"name":123}' \
'http://127.0.0.1:8899/api/kernels?token=VALIDTOKEN'
# Resulting log lines (pre-patch):
# "Referer": "http://127.0.0.1:8899/tree?token=REFERTOKEN",
# [E ... ServerApp] 500 POST /api/kernels?token=[secret] (...) referer=http://127.0.0.1:8899/tree?token=[secret]The server already had a scrub_param() helper that replaces known secret query parameters with '[secret]' in logged URLs. It was applied to the request line (so ?token= was redacted there) but the code that built the logged header block passed Referer through without calling that same helper.
The patch in commit 5251352 (PR #1681) runs the Referer value through the same scrubbing function before it is written to the log. CWE-532 applies directly: sensitive credential material was inserted into a log file that is typically readable by anyone with shell access to the server host.
The fix
Upgrade to jupyter_server 2.21.0 or later. As a short-term workaround, restrict filesystem read access to the Jupyter log files and avoid URL-based token flows where possible (prefer cookie-based or password-based auth).
Reported by Yann-P.
Related research