Jupyter_server (< 2.21.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/jupyter_server--2.21.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 18 Sep 2026 01:12:13 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgJupyter Server Authentication Token Leak in Error Logshttps://feed.craftedsignal.io/briefs/2026-09-jupyter-server-log-leak/Fri, 18 Sep 2026 01:12:13 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-jupyter-server-log-leak/Jupyter Server versions prior to 2.21.0 inadvertently expose authentication tokens in plain-text 500 error logs due to improper logging of the Referer header.Jupyter Server versions prior to 2.21.0 contain a security vulnerability (CVE-2026-86049) where sensitive authentication tokens are leaked within server error logs. When a request to the server results in a 500 Internal Server Error, the application logs a JSON block containing the request headers. Specifically, the 'Referer' header is captured and logged without sanitization. Because Jupyter often includes authentication tokens in the URL parameters during standard login and resource launch flows, these tokens are recorded in the logs in plain text. Any individual or service with read access to the server log files can extract these tokens, potentially enabling unauthorized access to the Jupyter environment. This issue highlights the risk of sensitive data exposure through diagnostic logging and emphasizes the need for input sanitization in logging frameworks.

Impact

Successful exploitation allows local or remote users with log access to harvest valid authentication tokens, potentially leading to account takeover or unauthorized access to Jupyter notebook environments. This vulnerability affects all deployments of Jupyter Server below version 2.21.0. Given the widespread use of Jupyter in data science and research environments, this exposure poses a significant risk to the confidentiality of stored data and compute resources.

Recommendation

  • Upgrade Jupyter Server to version 2.21.0 or later to ensure that header values are scrubbed before being logged.
  • Restrict file system permissions on server logs to ensure that only authorized administrative accounts have read access.
  • If possible, modify client workflows to avoid passing authentication tokens as URL parameters, opting for headers or cookies where supported.
  • Audit existing server logs for patterns matching token structures to identify potentially compromised credentials.
]]>highadvisorycredential-exposureloggingvulnerability