Executive brief
Jupyter Server is a web-based computational environment used by data scientists and researchers. When the server encounters an error (500 status), it logs HTTP request headers in plain text, including the Referer header. If a user's authentication token appears in the Referer URL during normal login flows, that token is written to server logs unredacted. Anyone with read access to server logs can extract these tokens to gain unauthorized access to user sessions and data.
Technical details
The vulnerability is an information disclosure flaw (CWE-532) in the error logging mechanism of `jupyter_server/log.py`. When a request returns a 500 error, the application logs a JSON block of request headers without sanitizing sensitive values. The Referer header is copied as-is, so authentication tokens embedded in URLs (e.g., `http://host/tree?token=TOKEN`) appear in logs in plain text. An attacker requires the ability to read server logs (typically local or with log aggregation access) and can trigger a 500 error with any malformed request. The vulnerability affects all versions before 2.21.0 and is fixed by scrubbing header values before logging. Patches are available in version 2.21.0 and later.
Affected products
- Project Jupyter Jupyter Server < 2.21.0
Timeline
- 2026-09-17: disclosed
- 2026-09-17: patched: Patched in version 2.21.0