CVE-2026-73116 Details
Description
Insufficiently Protected Credentials vulnerability in Apache Juneau. The Apache Juneau RestClient followed HTTP redirects while keeping credential headers from the original request, so a server that redirected the client to a different host or port, or from HTTPS to HTTP, could receive headers such as Authorization, Cookie, Proxy-Authorization and X-API-Key. This issue affects Apache Juneau: through 9.2.0. Users are recommended to upgrade to version 9.2.1, which fixes the issue. The fix applies to HTTP clients created by the RestClient builder; applications that supply their own HttpClient must disable automatic redirects or strip credential headers on cross-origin redirects themselves.
A vulnerability exists in the Apache Juneau REST client in versions through 9.2.0, where the client improperly handles credential headers during HTTP redirects. When a server redirects the client to a different host, port, or from HTTPS to HTTP, sensitive headers such as Authorization, Cookie, Proxy-Authorization, and X-API-Key can be exposed to the server. This issue arises because the REST client follows redirects while retaining these credential headers from the original request.
Users are advised to upgrade to Apache Juneau version 9.2.1, which addresses this vulnerability by removing credential headers when a redirect changes origin or downgrades to HTTP. For applications that supply their own HttpClient, equivalent redirect handling must be configured to remove credential headers on cross-origin redirects. If an immediate upgrade is not possible, disable automatic redirects on clients that send credentials to untrusted servers.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://lists.apache.org/thread.html/j05q7vw08j48o96tdlzcsd4sozx1lyl6 | [email protected] | AdvisoryBundleMailing ListRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-522 | Insufficiently Protected Credentials | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Apache Juneau | <= 9.2.0 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 5, 2026 | New CVE Received | [email protected] |