{"id":"CVE-2026-73100","kind":"vulnerability","aliases":["CVE-2026-73100"],"related":[],"title":"Apache Juneau: default REST logger writes auth headers to logs on server errors","description":"Insertion of Sensitive Information into Log File vulnerability in Apache Juneau.\n\nThe default REST server call logger records request headers for requests that end in a server error, without redacting them. Any client able to cause a server error gets headers such as Authorization, Cookie, Proxy-Authorization and X-API-Key written in cleartext to the application log, exposing them to anyone who can read the logs.\n\nThis issue affects Apache Juneau: through 9.2.0.\n\nUsers are recommended to upgrade to version 9.2.1, which fixes the issue.","summary":"The default REST server call logger records request headers such as Authorization, Cookie and X-API-Key in cleartext for requests that end in a server error. Anyone who can read the application logs can take those credentials and reuse them.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-juneau","java","logging","package","rest-server"],"not_affected_if":["default-config","no-juneau-rest-server"],"how_to_check":"- Check the Apache Juneau version in your build file, such as `juneau` in your Maven or Gradle dependencies.\n- Look in the application logs for the header names Authorization, Cookie or X-API-Key appearing next to server error entries.","fix":"- Apache Juneau through `9.2.0`: upgrade to `9.2.1`.","status":"open","published_at":"2026-11-05T12:17:51+00:00","first_seen_at":"2026-11-05T12:38:47+00:00","triaged_at":"2026-11-05T12:40:04+00:00","updated_at":"2026-11-05T12:40:04+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-05T12:40:04Z","model":"claude-haiku-5-5","output":{"fix":"- Apache Juneau through `9.2.0`: upgrade to `9.2.1`.","reach":"internet","title":"Apache Juneau: default REST logger writes auth headers to logs on server errors","impact":"medium","summary":"The default REST server call logger records request headers such as Authorization, Cookie and X-API-Key in cleartext for requests that end in a server error. Anyone who can read the application logs can take those credentials and reuse them.","audience":"developers","category":"package","nicknames":[],"who_cares":["apache-juneau","java","rest-server","logging"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Client credentials and session tokens readable from application logs","analyst_note":"","how_to_check":"- Check the Apache Juneau version in your build file, such as `juneau` in your Maven or Gradle dependencies.\n- Look in the application logs for the header names Authorization, Cookie or X-API-Key appearing next to server error entries.","plain_action":"","needs_analyst":false,"not_affected_if":["default-config","no-juneau-rest-server"],"who_is_affected":"Teams running a Java REST server built on Apache Juneau with the default REST server call logger enabled are exposed when requests trigger server errors. Anyone who can read those application logs can see the cleartext headers. Services that do not use Juneau's REST server, or that have replaced the default call logger, are not affected by this description.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000695,"input_tokens":4295,"output_tokens":530,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-73100':16A,19A '9.2.0':145C '9.2.1':153C 'abl':103C 'affect':141C 'anyon':57B,133C 'apach':1A,21B,79C,142C 'apache-juneau':20B 'api':45B,121C 'applic':62B,128C 'auth':7A 'author':40B,113C,117C 'call':33B,85C 'caus':105C 'cleartext':48B,125C 'client':102C 'cooki':41B,114C 'credenti':67B 'cve':14A,17A 'default':3A,30B,82C 'end':52B,93C 'error':13A,56B,97C,108C 'expos':130C 'file':76C 'fix':155C 'get':109C 'header':8A,37B,89C,110C 'inform':73C 'insert':70C 'issu':140C,157C 'java':23B 'juneau':2A,22B,80C,143C 'key':46B,122C 'log':10A,24B,63B,75C,129C,138C 'logger':5A,34B,86C 'packag':25B 'proxi':116C 'proxy-author':115C 'read':60B,136C 'recommend':148C 'record':35B,87C 'redact':99C 'request':36B,50B,88C,91C 'rest':4A,27B,31B,83C 'rest-serv':26B 'reus':69B 'sensit':72C 'server':12A,28B,32B,55B,84C,96C,107C 'take':65B 'upgrad':150C 'user':146C 'version':152C 'vulner':77C 'without':98C 'write':6A 'written':123C 'x':44B,120C 'x-api-key':43B,119C","nicknames":[],"mitigations":[],"who_affected":"Teams running a Java REST server built on Apache Juneau with the default REST server call logger enabled are exposed when requests trigger server errors. Anyone who can read those application logs can see the cleartext headers. Services that do not use Juneau's REST server, or that have replaced the default call logger, are not affected by this description.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apachejuneau","critical","java","logging","package","restserver"],"campaign_type":null,"first_public_at":"2026-11-05T12:17:51+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-73100","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73100","severity":null,"published_at":"2026-11-05T12:17:51+00:00","modified_at":"2026-11-05T12:17:51+00:00","first_seen_at":"2026-11-05T12:38:47+00:00","fetched_at":"2026-11-05T12:38:47+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}