PyPI/jupyter-server CVE-2026-86049: high 7.1

Jupyter Server: 5xx request logging leaks token-bearing Referer header values

Action: Upgrade jupyter-server to 2.21.0 or later.

pip install jupyter-server==2.21.0

Affected

Fixed versions

Sources

• osv: GHSA-c3mw-737p-c7g2
• https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-c3mw-737p-c7g2
• https://github.com/jupyter-server/jupyter_server/pull/1681
• https://github.com/jupyter-server/jupyter_server/commit/52513529af7096e622c00911b17627b266294717
• https://github.com/jupyter-server/jupyter_server
• https://github.com/jupyter-server/jupyter_server/releases/tag/v2.21.0

CVE-2026-86049 · published 2026-09-17T20:28:55Z · modified 2026-10-01T17:55:42.193212736Z · JSON