SB2026090355 - Inclusion of Sensitive Information in Log Files in Jupyter Server

Description

This security bulletin contains information about 1 vulnerability.

1) Inclusion of Sensitive Information in Log Files (CVE-ID: N/A)

CWE-ID: CWE-532 - Information Exposure Through Log Files

CVSSv4: 7.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to insertion of sensitive information into log files in jupyter_server/log.py when logging request headers for requests that return a 500 error. A remote user can send a malformed request with a token-bearing Referer header to disclose sensitive information.

User interaction is required during normal token-based login and launch flows that place the token in the Referer URL.

Remediation

Install update from vendor's website.

References

• https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-c3mw-737p-c7g2
• https://github.com/jupyter-server/jupyter_server/commit/52513529af7096e622c00911b17627b266294717