Cross-Site Request Forgery Vulnerability in Apache Juneau
CVE-2026-73099

10CRITICAL

Key Information:

Vendor

Apache
Status
Apache Juneau
Vendor
CVE Published:
5 November 2026

What is CVE-2026-73099?

A Cross-Site Request Forgery vulnerability exists in the Apache Juneau REST server which allows an attacker to exploit the 'content' query parameter. When this parameter is accepted, it replaces the request body for any HTTP method, including GET, without requiring a CORS preflight check. This exploitation can lead to unauthorized actions being executed on behalf of users, making it vital for users of Apache Juneau to upgrade to version 9.2.1 or disable the 'content' parameter to enhance security.

Affected Version(s)

Apache Juneau 0 < 9.2.1

References

https://lists.apache.org/thread.html/j05q7vw08j48o96tdlzc...
vendor-advisory

CVSS V4

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.