{"id":"CVE-2026-73116","kind":"vulnerability","aliases":["CVE-2026-73116"],"related":[],"title":"Apache Juneau: RestClient leaks credential headers across redirects to other hosts","description":"Insufficiently Protected Credentials vulnerability in Apache Juneau.\n\nThe Apache Juneau RestClient followed HTTP redirects while keeping credential headers from the original request, so a server that redirected the client to a different host or port, or from HTTPS to HTTP, could receive headers such as Authorization, Cookie, Proxy-Authorization and X-API-Key.\n\nThis issue affects Apache Juneau: through 9.2.0.\n\nUsers are recommended to upgrade to version 9.2.1, which fixes the issue. The fix applies to HTTP clients created by the RestClient builder; applications that supply their own HttpClient must disable automatic redirects or strip credential headers on cross-origin redirects themselves.","summary":"Apache Juneau's RestClient kept Authorization, Cookie, Proxy-Authorization and X-API-Key headers when following HTTP redirects. A server that redirects the client to another host, port, or from HTTPS to HTTP can read those credentials.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-juneau","java","package","rest-client"],"not_affected_if":["does-not-use-restclient","version-9.2.1-or-later"],"how_to_check":"- Look for Apache Juneau in the project's dependencies, for example the `juneau-rest-client` artifact, and note its version.\n- Check whether the application builds its clients with the RestClient builder or supplies its own HttpClient.","fix":"- Apache Juneau: upgrade to `9.2.1`.\n- Applications that supply their own HttpClient: disable automatic redirects or strip credential headers on cross-origin redirects, per the advisory.","status":"open","published_at":"2026-11-05T12:17:51+00:00","first_seen_at":"2026-11-05T12:38:48+00:00","triaged_at":"2026-11-05T12:40:01+00:00","updated_at":"2026-11-05T12:40:01+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-05T12:40:01Z","model":"claude-haiku-5-5","output":{"fix":"- Apache Juneau: upgrade to `9.2.1`.\n- Applications that supply their own HttpClient: disable automatic redirects or strip credential headers on cross-origin redirects, per the advisory.","reach":"network","title":"Apache Juneau: RestClient leaks credential headers across redirects to other hosts","impact":"high","summary":"Apache Juneau's RestClient kept Authorization, Cookie, Proxy-Authorization and X-API-Key headers when following HTTP redirects. A server that redirects the client to another host, port, or from HTTPS to HTTP can read those credentials.","audience":"developers","category":"package","nicknames":[],"who_cares":["java","apache-juneau","rest-client"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"credentials sent to a redirect target, enabling account takeover","analyst_note":"","how_to_check":"- Look for Apache Juneau in the project's dependencies, for example the `juneau-rest-client` artifact, and note its version.\n- Check whether the application builds its clients with the RestClient builder or supplies its own HttpClient.","plain_action":"","needs_analyst":false,"not_affected_if":["does-not-use-restclient","version-9.2.1-or-later"],"who_is_affected":"Applications that use Apache Juneau's RestClient through version 9.2.0 to call external or third-party services are exposed, since a malicious or compromised server can redirect the client and capture its credentials. Clients built with the RestClient builder are covered by the fix; applications using their own HttpClient must handle redirects themselves until they do. Apps that do not use Juneau's RestClient can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000745,"input_tokens":4353,"output_tokens":619,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-73116':14A,17A '9.2.0':126C '9.2.1':134C 'across':7A 'affect':122C 'anoth':53B 'apach':1A,19B,26B,70C,73C,123C 'apache-juneau':18B 'api':39B,118C 'appli':141C 'applic':150C 'author':31B,35B,110C,114C 'automat':158C 'builder':149C 'client':25B,51B,93C,144C 'cooki':32B,111C 'could':105C 'creat':145C 'credenti':5A,64B,67C,81C,162C 'cross':166C 'cross-origin':165C 'cve':12A,15A 'differ':96C 'disabl':157C 'fix':136C,140C 'follow':43B,76C 'header':6A,41B,82C,107C,163C 'host':11A,54B,97C 'http':44B,60B,77C,104C,143C 'httpclient':155C 'https':58B,102C 'insuffici':65C 'issu':121C,138C 'java':21B 'juneau':2A,20B,27B,71C,74C,124C 'keep':80C 'kept':30B 'key':40B,119C 'leak':4A 'must':156C 'origin':85C,167C 'packag':22B 'port':55B,99C 'protect':66C 'proxi':34B,113C 'proxy-author':33B,112C 'read':62B 'receiv':106C 'recommend':129C 'redirect':8A,45B,49B,78C,91C,159C,168C 'request':86C 'rest':24B 'rest-client':23B 'restclient':3A,29B,75C,148C 'server':47B,89C 'strip':161C 'suppli':152C 'upgrad':131C 'user':127C 'version':133C 'vulner':68C 'x':38B,117C 'x-api-key':37B,116C","nicknames":[],"mitigations":[],"who_affected":"Applications that use Apache Juneau's RestClient through version 9.2.0 to call external or third-party services are exposed, since a malicious or compromised server can redirect the client and capture its credentials. Clients built with the RestClient builder are covered by the fix; applications using their own HttpClient must handle redirects themselves until they do. Apps that do not use Juneau's RestClient can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apachejuneau","critical","java","package","restclient"],"campaign_type":null,"first_public_at":"2026-11-05T12:17:51+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-73116","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73116","severity":null,"published_at":"2026-11-05T12:17:51+00:00","modified_at":"2026-11-05T12:17:51+00:00","first_seen_at":"2026-11-05T12:38:48+00:00","fetched_at":"2026-11-05T12:38:48+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}