Jupyter Server: Referer header is logged unscrubbed, leaking auth tokens into server logs

Impact

The 5xx logging path copies the Referer header into a JSON header block without the token scrubbing applied to the request URI, so any request that errors with HTTP 500 while carrying a token-bearing URL in Referer writes that token to the log in plaintext. Anyone who can read those logs - and on a GPU fleet that usually means the whole platform team plus whatever central log pipeline the cluster ships to - can replay the token and act with the notebook owner's permissions: read their data, run code on their GPU allocation, and reach anything mounted into the notebook pod. The credential outlives the incident that leaked it, since Jupyter tokens do not rotate on their own.

Who can reach it

Reading the Jupyter Server logs (local file, container stdout, or the cluster log aggregator) is enough for the attacker; no Jupyter authentication needed on their part. The leak itself requires a user request that 500s while its Referer carries a token URL.

What to do

Upgrade Jupyter Server to 2.21.0 and restart the affected notebook servers - on Kubernetes this means rolling the single-user pods, which interrupts running kernels. Also treat existing logs as credential material: rotate tokens for any user whose token may already appear, and scrub or expire the collected logs.

References

Related entries

• n8n OpenAI Chat Model node: model-search path ignores credential domain limits and leaks the API keyCVE-2026-86082 · n8n OpenAI Chat Model node (LMChatOpenAi loadModels.ts model-search path)High
• vLLM: forged FLAC sample rate bypasses duration limit and crashes the API serverCVE-2026-90555 · vLLM (OpenAI-compatible transcription endpoint, audio header validation)High
• Hugging Face Transformers: path traversal in save_pretrained() writes files outside the save directoryCVE-2026-9856 · Hugging Face Transformers - save_pretrained() in PreTrainedTokenizerBase and ProcessorMixinHigh
• MLflow (`spark_udf` dir perms): Excessive directory permissionsCVE-2024-27134 · MLflow (`spark_udf` dir perms)High
• NVIDIA NemoClaw: code injection in the migration command gives a local user execution as the tool's privilegesCVE-2026-65082 · NVIDIA NemoClaw for Linux (migration command)High
• Hugging Face Accelerate: unsanitized shard paths in a checkpoint index give arbitrary file read and hangsCVE-2026-69112 · Hugging Face Accelerate (load_checkpoint_in_model / load_checkpoint_and_dispatch weight_map handling)Medium