Credential Exposure Vulnerability in Apache Juneau
CVE-2026-73116

10CRITICAL

Key Information:

Vendor

Apache
Status
Apache Juneau
Vendor
CVE Published:
5 November 2026

What is CVE-2026-73116?

A credential exposure vulnerability in Apache Juneau's RestClient allows the retention of sensitive credential headers during HTTP redirects. This issue arises when the RestClient redirects to a different host or port or transitions from HTTPS to HTTP, posing a risk of sensitive data leakage. Affected versions prior to 9.2.1 are at risk, with users advised to upgrade to prevent unauthorized access to sensitive information, particularly when using applications that do not manage their HttpClient and automatic redirects.

Affected Version(s)

Apache Juneau 0 < 9.2.1

Apache Juneau 0 < 9.2.1

References

https://lists.apache.org/thread.html/j05q7vw08j48o96tdlzc...
vendor-advisory

CVSS V4

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.