CVE-2026-86049: jupyter-server jupyter_server
Vulnerability summary
CVE-2026-86049 is a high (CVSS 7.1) vulnerability in jupyter-server jupyter_server. EPSS estimates a 0.42% chance of exploitation in the next 30 days, higher than 34.7% of scored vulnerabilities.
Timeline
- 17-09-2026PublishedVulnerability first disclosed.
- 18-09-2026Last modifiedVulnerability information updated.
Description
Jupyter Server is the backend for Jupyter web applications. Prior to version 2.21.0, the 5xx request logging path in jupyter_server/log.py copies the Referer header into a JSON header block without applying the token scrubbing used for the request URI. A request that returns HTTP 500 while the Referer contains a token-bearing URL can therefore write that token to server logs in plaintext. An attacker who can read those logs can recover the token and use the affected user's Jupyter Server permissions. This issue is fixed in version 2.21.0.
CVSS metrics
7 scores · 7 sources · 1 version- OSV · PypiEcosystem advisory · calculated7.1HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated7.1HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.1HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
- OSV · WolfiEcosystem advisory · calculated7.1HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated7.1HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
- NVDNIST7.1HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.42%
Chance of exploitation in the next 30 days
Percentile
35%
Versus all other CVEs
30-day change
+0.18 pp
From 0.24% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard2 products
- jupyter-base-notebook< 7.6.2-r3
- tensorflow-cpu-jupyter< 2.21.0-r10
Debian1 product
- jupyter-serverAll versions (No fix recorded)
Jupyter-server1 product
- jupyter_server< 2.21.0
PyPI1 product
- jupyter-server< 2.21.0
Ubuntu1 product
- jupyter-serverAll versions (No fix recorded)
Wolfi1 product
- jupyter-base-notebook< 7.6.2-r3
6 vendors · 7 products
References
12 links- github.com/jupyter-server/jupyter_server/security/advisories/GHSA-c3mw-737p-c7g2X Refsource CONFIRMWEBREPORTAdvisory
- github.com/jupyter-server/jupyter_server/commit/52513529af7096e622c00911b17627b266294717X Refsource MISCWEBREPORTFIX
