Loading vulnerability…
CSRF in Apache Juneau REST Server content Query Parameter
CVE-2026-73099 is a cross-site request forgery vulnerability affecting Apache Juneau juneau-rest-server through version 9.2.0. The REST server enables a content query parameter by default that replaces the request body on every HTTP method, including GET. Cross-site links or embedded resources can therefore deliver attacker-chosen request bodies without a CORS preflight, bypassing CSRF defenses that rely on HTTP method or content type rather than anti-CSRF tokens.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Attackers can induce unauthorized requests carrying attacker-controlled bodies to application endpoints. Consequences depend on the endpoint's functionality and the authorization context in which the request executes, potentially including unauthorized state changes. Defenses based solely on request method or content type do not prevent this attack.
If you can’t patch tonight, do this now.
For applications that do not require the content query parameter, set disableContentParam to true. Protect sensitive operations with validated anti-CSRF tokens rather than relying solely on HTTP method or content type.
Patch, then assume compromise.
Upgrade Apache Juneau juneau-rest-server to version 9.2.1 or later. Upgrade shaded and aggregate artifacts embedding the affected module as well. Version 9.2.1 restricts the content query parameter override to PUT and POST requests.
No public exploits tracked yet. Mallory keeps watching.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.