CVE-2026-73100 Details
Description
Insertion of Sensitive Information into Log File vulnerability in Apache Juneau. The default REST server call logger records request headers for requests that end in a server error, without redacting them. Any client able to cause a server error gets headers such as Authorization, Cookie, Proxy-Authorization and X-API-Key written in cleartext to the application log, exposing them to anyone who can read the logs. This issue affects Apache Juneau: through 9.2.0. Users are recommended to upgrade to version 9.2.1, which fixes the issue.
A vulnerability allowing the insertion of sensitive information into log files has been identified in Apache Juneau. This issue arises in the default REST server call logger, which records request headers for requests that result in a server error, without redacting sensitive information. Headers such as Authorization, Cookie, Proxy-Authorization, and X-API-Key are logged in cleartext, exposing them to anyone with access to the application logs. This vulnerability affects Apache Juneau versions through 9.2.0.
Users are advised to upgrade to Apache Juneau version 9.2.1, which addresses this vulnerability by redacting sensitive headers in the default request logger. If an immediate upgrade is not possible, consider configuring a custom call logger that does not include request headers.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://lists.apache.org/thread.html/j05q7vw08j48o96tdlzcsd4sozx1lyl6 | [email protected] | AdvisoryBundleMailing ListRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-532 | Insertion of Sensitive Information into Log File | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Apache Juneau | <= 9.2.0 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 5, 2026 | New CVE Received | [email protected] |