CVE-2026-73100: Apache Juneau: Sensitive request headers logged in cleartext by the default request logger on server errors

Published Nov 4, 2026

Updated

Insertion of Sensitive Information into Log File vulnerability in Apache Juneau.

The default REST server call logger records request headers for requests that end in a server error, without redacting them. Any client able to cause a server error gets headers such as Authorization, Cookie, Proxy-Authorization and X-API-Key written in cleartext to the application log, exposing them to anyone who can read the logs.

This issue affects Apache Juneau: through 9.2.0.

Users are recommended to upgrade to version 9.2.1, which fixes the issue.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache Juneau to a version that resolves this vulnerability.
Fixed in 9.2.1

Event History

Nov 5, 2026

CVE Published

via MITRE·11:50 AM

Data Sourced

via MITRE·11:50 AM

DescriptionWeakness

Data Sourced

via NVD·12:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Apache Juneau REST servers using the default request logger are exposed through version 9.2.0. Exposure is most significant where untrusted clients can reach the server and other users or systems can read its application logs.

What does an attacker need to do to exploit it?

An attacker only needs to be able to send requests that cause a server error. The affected logger then writes request headers, including Authorization, Cookie, Proxy-Authorization, and X-API-Key, to the application log in cleartext.

Are default configurations affected?

Yes. The vulnerable behavior is in the default REST server call logger, which records request headers for requests ending in a server error without redaction.

What should teams do if they cannot upgrade immediately?

Restrict access to application logs and treat logs generated from server-error requests as potentially containing exposed credentials or session data. Review those logs for sensitive headers and rotate any credentials or tokens found there.

How can I determine whether sensitive data may already have been exposed?

Review application logs from affected Apache Juneau deployments for server-error request entries containing headers such as Authorization, Cookie, Proxy-Authorization, or X-API-Key. Any such values should be considered exposed to parties with log access.

CVE-2026-73100: Apache Juneau: Sensitive request headers logged in cleartext by the default request logger on server errors

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to exploit it?

Are default configurations affected?

What should teams do if they cannot upgrade immediately?

How can I determine whether sensitive data may already have been exposed?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to exploit it?

Are default configurations affected?

What should teams do if they cannot upgrade immediately?

How can I determine whether sensitive data may already have been exposed?