Loading vulnerability…
Sensitive Request Header Logging in Apache Juneau
CVE-2026-73100 is a sensitive-information logging vulnerability affecting Apache Juneau juneau-rest-server and juneau-rest-common through version 9.2.0. The default REST server call logger records request headers without redaction when a request results in a server error. Sensitive values in Authorization, Cookie, Proxy-Authorization, and X-API-Key headers are consequently written in cleartext to application logs and exposed to anyone able to read those logs. Apache Juneau 9.2.1 redacts credential headers by default.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Authentication credentials, session cookies, proxy credentials, and API keys can be disclosed through application logs. Readers of affected logs may reuse valid exposed secrets to impersonate users or access protected services, subject to the credentials' permissions and validity. Triggering a server error causes disclosure into logs; it does not itself provide remote access to those logs.
If you can’t patch tonight, do this now.
If upgrading is delayed, configure a REST server call logger that omits request headers. Restrict access to existing application logs to limit exposure of previously recorded credentials.
Patch, then assume compromise.
Upgrade Apache Juneau juneau-rest-server and juneau-rest-common to version 9.2.1, including shaded or aggregate artifacts embedding affected modules. Review existing application logs for exposed secrets and rotate affected credentials and API keys or invalidate exposed sessions. Upgrading prevents further unredacted credential-header logging but does not remove secrets already recorded.
No public exploits tracked yet. Mallory keeps watching.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.