CVE-2026-73116 · Package
NO FIX YET · SEE WHAT TO DO
Apache Juneau's RestClient kept Authorization, Cookie, Proxy-Authorization and X-API-Key headers when following HTTP redirects. A server that redirects the client to another host, port, or from HTTPS to HTTP can read those credentials.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications that use Apache Juneau's RestClient through version 9.2.0 to call external or third-party services are exposed, since a malicious or compromised server can redirect the client and capture its credentials. Clients built with the RestClient builder are covered by the fix; applications using their own HttpClient must handle redirects themselves until they do. Apps that do not use Juneau's RestClient can skip it.
Not affected if does-not-use-restclient, version-9.2.1-or-later
Who cares apache-juneau, java, rest-client
juneau-rest-client artifact, and note its version.9.2.1.Insufficiently Protected Credentials vulnerability in Apache Juneau.
The Apache Juneau RestClient followed HTTP redirects while keeping credential headers from the original request, so a server that redirected the client to a different host or port, or from HTTPS to HTTP, could receive headers such as Authorization, Cookie, Proxy-Authorization and X-API-Key.
This issue affects Apache Juneau: through 9.2.0.
Users are recommended to upgrade to version 9.2.1, which fixes the issue. The fix applies to HTTP clients created by the RestClient builder; applications that supply their own HttpClient must disable automatic redirects or strip credential headers on cross-origin redirects themselves.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.