CVE-2026-73100
Apache Software Foundation Apache Juneau
Published 5 Nov 2026 · updated 5 Nov 2026 · Deferred
10.0 Critical · CVSS 4.0, apache.org
Description
Insertion of Sensitive Information into Log File vulnerability in Apache Juneau. The default REST server call logger records request headers for requests that end in a server error, without redacting them. Any client able to cause a server error gets headers such as Authorization, Cookie, Proxy-Authorization and X-API-Key written in cleartext to the application log, exposing them to anyone who can read the logs. This issue affects Apache Juneau: through 9.2.0. Users are recommended to upgrade to version 9.2.1, which fixes the issue.