https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 05:22:46 +0000 https://vulnerability.circl.lu/vuln/cve-2026-86049 <p><strong>Affected:</strong> jupyter-server jupyter_server</p> <p>Jupyter Server is the backend for Jupyter web applications. Prior to version 2.21.0, the 5xx request logging path in jupyter_server/log.py copies the Referer header into a JSON header block without applying the token scrubbing used for the request URI. A request that returns HTTP 500 while the Referer contains a token-bearing URL can therefore write that token to server logs in plaintext. An attacker who can read those logs can recover the token and use the affected user&#39;s Jupyter Server permissions. This issue is fixed in version 2.21.0.</p> <p><strong>Affected:</strong> jupyter-server jupyter_server</p> <p>Jupyter Server is the backend for Jupyter web applications. Prior to version 2.21.0, the 5xx request logging path in jupyter_server/log.py copies the Referer header into a JSON header block without applying the token scrubbing used for the request URI. A request that returns HTTP 500 while the Referer contains a token-bearing URL can therefore write that token to server logs in plaintext. An attacker who can read those logs can recover the token and use the affected user&#39;s Jupyter Server permissions. This issue is fixed in version 2.21.0.</p> https://vulnerability.circl.lu/vuln/cve-2026-86049