CVE-2026-73116: Apache Juneau: REST client forwards credentials to a different origin when following HTTP redirects

Published Nov 4, 2026

Updated

Insufficiently Protected Credentials vulnerability in Apache Juneau.

The Apache Juneau RestClient followed HTTP redirects while keeping credential headers from the original request, so a server that redirected the client to a different host or port, or from HTTPS to HTTP, could receive headers such as Authorization, Cookie, Proxy-Authorization and X-API-Key.

This issue affects Apache Juneau: through 9.2.0.

Users are recommended to upgrade to version 9.2.1, which fixes the issue. The fix applies to HTTP clients created by the RestClient builder; applications that supply their own HttpClient must disable automatic redirects or strip credential headers on cross-origin redirects themselves.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache Juneau to a version that resolves this vulnerability.
Fixed in 9.2.1
Configuration
Disable automatic redirects when supplying a custom HttpClient, or strip credential headers on cross-origin redirects.
Apache Juneau custom HttpClient automatic redirects = disabled

Event History

Nov 5, 2026

CVE Published

via MITRE·11:53 AM

Data Sourced

via MITRE·11:53 AM

DescriptionWeakness

Data Sourced

via NVD·12:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which applications are exposed to credential leakage?

Applications using Apache Juneau RestClient versions through 9.2.0 are affected when the client follows a redirect to a different host or port, or from HTTPS to HTTP. The risk is greatest when requests include Authorization, Cookie, Proxy-Authorization, or X-API-Key headers.

What does an attacker need to exploit this issue?

An attacker needs a server involved in the client's request flow to return an HTTP redirect pointing to another origin or to a less secure HTTP endpoint. No client-side privileges or user interaction are required according to the supplied severity vector.

Does upgrading Juneau address every RestClient deployment?

Version 9.2.1 fixes clients created through the RestClient builder. Applications that provide their own HttpClient must independently disable automatic redirects or remove credential headers when redirects cross origins.

What can be done if an immediate upgrade is not possible?

Disable automatic redirects for affected HTTP clients, or ensure credential headers are stripped before following redirects to a different host, port, or HTTP scheme. This is also required for applications using a custom HttpClient.

CVE-2026-73116: Apache Juneau: REST client forwards credentials to a different origin when following HTTP redirects

Remediation

Event History

Frequently Asked Questions

Which applications are exposed to credential leakage?

What does an attacker need to exploit this issue?

Does upgrading Juneau address every RestClient deployment?

What can be done if an immediate upgrade is not possible?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to credential leakage?

What does an attacker need to exploit this issue?

Does upgrading Juneau address every RestClient deployment?

What can be done if an immediate upgrade is not possible?