CVE-2026-86049

Jupyter Server is the backend for Jupyter web applications. Prior to version 2.21.0, the 5xx request logging path in jupyter_server/log.py copies the Referer header into a JSON header block without applying the token scrubbing used for the request URI. A request that returns HTTP 500 while the Referer contains a token-bearing URL can therefore write that token to server logs in plaintext. An attacker who can read those logs can recover the token and use the affected user's Jupyter Server permissions. This issue is fixed in version 2.21.0.

• CWE-532

• https://github.com/jupyter-server/jupyter_server/commit/52513529af7096e622c00911b17627b266294717
• https://github.com/jupyter-server/jupyter_server/pull/1681
• https://github.com/jupyter-server/jupyter_server/releases/tag/v2.21.0
• https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-c3mw-737p-c7g2

Published

Sep 17, 2026

Last Modified

Sep 17, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-8603In ScadaBR version 1.2.0, an OS Command Injection vulnerabil…9.8
• CVE-2026-86038libp2p is a JavaScript implementation of the libp2p networki…7.5
• CVE-2026-86039libp2p is a JavaScript implementation of the libp2p networki…8.2
• CVE-2026-8604In ScadaBR version 1.2.0, a CSRF vulnerability could allow a…8.8
• CVE-2026-86040libp2p is a JavaScript implementation of the libp2p networki…7.5
• CVE-2026-86043Skipper is an HTTP router and reverse proxy for service comp…7.5
• CVE-2026-8605In ScadaBR version 1.2.0, a Use of Hard-Coded Credentials vu…9.8
• CVE-2026-8606A Server-Side Request Forgery (SSRF) vulnerability was ident…5.9
• CVE-2026-86060RouterOS contains an argument-handling flaw in the SSH login…9.8
• CVE-2026-8607The Points Management System For Gamification, Ranks, Badges…6.4
• CVE-2026-86071Junrar is an open source Java RAR archive library. Prior to …3.7
• CVE-2026-86073n8n is an open source workflow automation platform. Prior to…7.6