CVE-2026-73100 · Package
NO FIX YET · SEE WHAT TO DO
The default REST server call logger records request headers such as Authorization, Cookie and X-API-Key in cleartext for requests that end in a server error. Anyone who can read the application logs can take those credentials and reuse them.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running a Java REST server built on Apache Juneau with the default REST server call logger enabled are exposed when requests trigger server errors. Anyone who can read those application logs can see the cleartext headers. Services that do not use Juneau's REST server, or that have replaced the default call logger, are not affected by this description.
Not affected if default-config, no-juneau-rest-server
Who cares apache-juneau, java, logging, rest-server
juneau in your Maven or Gradle dependencies.9.2.0: upgrade to 9.2.1.Insertion of Sensitive Information into Log File vulnerability in Apache Juneau.
The default REST server call logger records request headers for requests that end in a server error, without redacting them. Any client able to cause a server error gets headers such as Authorization, Cookie, Proxy-Authorization and X-API-Key written in cleartext to the application log, exposing them to anyone who can read the logs.
This issue affects Apache Juneau: through 9.2.0.
Users are recommended to upgrade to version 9.2.1, which fixes the issue.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.