10.0 Critical

CVE-2026-73100 Apache Juneau: Sensitive request headers logged in cleartext by the default request logger on server errors

Description

Insertion of Sensitive Information into Log File vulnerability in Apache Juneau. The default REST server call logger records request headers for requests that end in a server error, without redacting them. Any client able to cause a server error gets headers such as Authorization, Cookie, Proxy-Authorization and X-API-Key written in cleartext to the application log, exposing them to anyone who can read the logs. This issue affects Apache Juneau: through 9.2.0. Users are recommended to upgrade to version 9.2.1, which fixes the issue.

CVSS 4.0 detail

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Exploitable remotely over the network, without an account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector: Network
Attack complexity: Low
Attack requirements: None
Privileges required: None
Interaction: None
Confidentiality: High
Integrity: High
Availability: High
Confidentiality of other systems: High
Integrity of other systems: High
Availability of other systems: High

Affected products and versions

Product	Affected versions	Fixed in
Apache Juneau 9.2	earliest → < 9.2.1	9.2.1

References

lists.apache.org lists.apache.org

Timeline

Published November 5, 2026
Last modified November 5, 2026

The 9 CVEs of Apache Juneau →

CVE-2026-121489 Apache Juneau: Path traversal in DirectoryResource allows reading files outside the configured root directory 10.0 Critical CVE-2026-96677 Apache Juneau: Cross-site scripting via unescaped request variables in HTML-doc chrome 10.0 Critical CVE-2026-73117 Apache Juneau: Response header CRLF injection and open redirect when applications set headers or redirect targets from request data 10.0 Critical CVE-2026-73116 Apache Juneau: REST client forwards credentials to a different origin when following HTTP redirects 10.0 Critical

Track this CVE