DEBIAN-CVE-2026-86049
Jupyter Server is the backend for Jupyter web applications. Prior to version 2.21.0, the 5xx request logging path in jupyter_server/log.py copies the Referer header into a JSON header block without applying the token scrubbing used for the request URI. A request that returns HTTP 500 while the Referer contains a token-bearing URL can therefore write that token to server logs in plaintext. An attacker who can read those logs can recover the token and use the affected user's Jupyter Server permissions. This issue is fixed in version 2.21.0.
DEBIAN-CVE-2026-86049
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:DEBIAN-CVE-2026-86049
jupyter-server
Source reference: /affected/0/package/name
- Affected versions
- 1.23.3-1
Source reference:
/affected/0/versions1.23.3-2Source reference:
/affected/0/versions2.14.0-1Source reference:
/affected/0/versions2.14.2-1Source reference:
/affected/0/versions2.14.2-2Source reference:
/affected/0/versions2.14.2-3Source reference:
/affected/0/versions2.14.2-4Source reference:
/affected/0/versions2.14.2-5Source reference:
/affected/0/versions2.15.0-1Source reference:
/affected/0/versions2.17.0-1Source reference:
/affected/0/versions2.20.0-1Source reference:
/affected/0/versions2.20.0-2Source reference:
/affected/0/versions2.20.0-3Source reference:
/affected/0/versions2.9.1-1Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
jupyter-server
Source reference: /affected/1/package/name
- Affected versions
- 2.15.0-1
Source reference:
/affected/1/versions2.17.0-1Source reference:
/affected/1/versions2.20.0-1Source reference:
/affected/1/versions2.20.0-2Source reference:
/affected/1/versions2.20.0-3Source reference:
/affected/1/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
jupyter-server
Source reference: /affected/2/package/name
- Affected versions
- 2.15.0-1
Source reference:
/affected/2/versions2.17.0-1Source reference:
/affected/2/versions2.20.0-1Source reference:
/affected/2/versions2.20.0-2Source reference:
/affected/2/versions2.20.0-3Source reference:
/affected/2/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "jupyter-server",
"purl": "pkg:deb/debian/jupyter-server?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"1.23.3-1",
"1.23.3-2",
"2.14.0-1",
"2.14.2-1",
"2.14.2-2",
"2.14.2-3",
"2.14.2-4",
"2.14.2-5",
"2.15.0-1",
"2.17.0-1",
"2.20.0-1",
"2.20.0-2",
"2.20.0-3",
"2.9.1-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-86049.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "jupyter-server",
"purl": "pkg:deb/debian/jupyter-server?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"2.15.0-1",
"2.17.0-1",
"2.20.0-1",
"2.20.0-2",
"2.20.0-3"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-86049.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "jupyter-server",
"purl": "pkg:deb/debian/jupyter-server?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"2.15.0-1",
"2.17.0-1",
"2.20.0-1",
"2.20.0-2",
"2.20.0-3"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-86049.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #15034 · Revision 1
- Added to Heist Feed
- Publisher date