Is CVE-2026-86049 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86049 being exploited in the wild.

How severe is CVE-2026-86049?

High severity, with a CVSS score of 7.1, published 17 September 2026.

Which products and versions are affected?

jupyter-server (PyPI) ECOSYSTEM:introduced=0,fixed=2.21.0.

Is there a fix for CVE-2026-86049?

Yes. jupyter-server (PyPI): upgrade to 2.21.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-86049 attacked?

It is attacked over the network.

Am I affected by CVE-2026-86049?

Check whether you run jupyter-server (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86049: Jupyter Server token leakage in 5xx error logs

CVE-2026-86049 · Severity: high · CVSS 7.1 · Published 2026-09-17

Jupyter Server is a web-based computational environment used by data scientists and researchers. When the server encounters an error (500 status), it logs HTTP request headers in plain text, including the Referer header. If a user's authentication token appears in the Referer URL during normal login flows, that token is written to server logs unredacted. Anyone with read access to server logs can extract these tokens to gain unauthorized access to user sessions and data.

Technologies: jupyter-server (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-86049 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86049 being exploited in the wild.
How severe is CVE-2026-86049?: High severity, with a CVSS score of 7.1, published 17 September 2026.
Which products and versions are affected?: jupyter-server (PyPI) ECOSYSTEM:introduced=0,fixed=2.21.0.
Is there a fix for CVE-2026-86049?: Yes. jupyter-server (PyPI): upgrade to 2.21.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-86049 attacked?: It is attacked over the network.
Am I affected by CVE-2026-86049?: Check whether you run jupyter-server (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

jupyter-server (PyPI): upgrade to 2.21.0 or later
```
pip install "jupyter-server>=2.21.0"
```

Technical details

The vulnerability is an information disclosure flaw (CWE-532) in the error logging mechanism of `jupyter_server/log.py`. When a request returns a 500 error, the application logs a JSON block of request headers without sanitizing sensitive values. The Referer header is copied as-is, so authentication tokens embedded in URLs (e.g., `http://host/tree?token=TOKEN`) appear in logs in plain text. An attacker requires the ability to read server logs (typically local or with log aggregation access) and can trigger a 500 error with any malformed request. The vulnerability affects all versions before 2.21.0 and is fixed by scrubbing header values before logging. Patches are available in version 2.21.0 and later.

Affected products

Project Jupyter Jupyter Server < 2.21.0

Identifiers

CVE-2026-86049
GHSA-c3mw-737p-c7g2
PYSEC-2026-4054

Timeline

2026-09-17: disclosed
2026-09-17: patched: Patched in version 2.21.0

References

https://api.github.com/users/DavidCarliez

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.