CVE-2026-86049highCWE-532

CVE-2026-86049: fallo de gravedad alta en jupyter-server jupyter_server

Jupyter Server: 5xx request logging leaks token-bearing Referer header values

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear jupyter server+ Monitorear jupyter-server

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.1epss 0.4%
Jupyter Server is the backend for Jupyter web applications. Prior to version 2.21.0, the 5xx request logging path in jupyter_server/log.py copies the Referer header into a JSON header block without applying the token scrubbing used for the request URI. A request that returns HTTP 500 while the Referer contains a token-bearing URL can therefore write that token to server logs in plaintext. An attacker who can read those logs can recover the token and use the affected user's Jupyter Server permissions. This issue is fixed in version 2.21.0.
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Productos afectados
jupyter-server · jupyter_server
CVEs relacionadas — jupyter-server jupyter_server

En el mismo producto, de las más peligrosas a las menos.

CVE-2020-26275MEDIUMOpen redirect vulnerabilityEPSS 1.4%CVE-2022-24757HIGHSensitive Auth & Cookie data stored in Jupyter server logsEPSS 1.3%CVE-2022-29241HIGHKnown or guessable hidden files may be accessed in Jupyter ServerEPSS 1.0%CVE-2023-49080LOWJupyter Server errors include tracebacks with path informationEPSS 0.8%CVE-2024-35178HIGHJupyter server on Windows discloses Windows user password hashEPSS 0.8%CVE-2023-39968MEDIUMOpen Redirect Vulnerability in jupyter-serverEPSS 0.7%