CVE-2026-73100 Apache Juneau: Sensitive request headers logged in cleartext by the default request logger on server errors
CriticalCVSS 10.0
- Published
- Updated
- Exploit status
- No public exploit known
Description
Insertion of Sensitive Information into Log File vulnerability in Apache Juneau.
The default REST server call logger records request headers for requests that end in a server error, without redacting them. Any client able to cause a server error gets headers such as Authorization, Cookie, Proxy-Authorization and X-API-Key written in cleartext to the application log, exposing them to anyone who can read the logs.
This issue affects Apache Juneau: through 9.2.0.
Users are recommended to upgrade to version 9.2.1, which fixes the issue.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.juneau/juneau-rest-server.(Maven) | < 9.2.1 | 9.2.1 |
| org.apache.juneau/juneau-rest-common(Maven) | < 9.2.1 | 9.2.1 |
References
- lists.apache.org vendor-advisory