Loading vulnerability…
Credential disclosure through redirects in Apache Juneau RestClient
CVE-2026-73116 is a credential-disclosure vulnerability affecting Apache Juneau juneau-rest-client and juneau-rest-common through version 9.2.0. RestClient retains sensitive headers from the original request when following HTTP redirects to a different host or port, or from HTTPS to HTTP. Headers including Authorization, Cookie, Proxy-Authorization, and X-API-Key can consequently be disclosed to unintended destinations or transmitted without transport encryption. Version 9.2.1 corrects redirect handling for HTTP clients created by the RestClient builder; application-supplied HttpClient instances require independent protections.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An unintended redirect destination can receive authentication credentials, session cookies, proxy credentials, or API keys attached to the original request. HTTPS-to-HTTP redirects additionally expose those values over an unencrypted connection. Depending on credential validity, scope, and privileges, disclosure can enable session compromise, impersonation, or unauthorized access to protected services and data.
If you can’t patch tonight, do this now.
Disable automatic redirects for credential-bearing requests, or handle redirects explicitly and remove Authorization, Cookie, Proxy-Authorization, and X-API-Key headers before following redirects that change host or port or downgrade HTTPS to HTTP. Apply these protections independently to application-supplied HttpClient instances, including after upgrading Juneau.
Patch, then assume compromise.
Upgrade Apache Juneau to version 9.2.1, including affected modules embedded in shaded or aggregate artifacts. The fix strips credential headers on origin-changing and HTTPS-to-HTTP redirects for HTTP clients created by the RestClient builder. Applications supplying their own HttpClient must separately disable automatic redirects or implement equivalent credential-header stripping; upgrading Juneau alone does not protect those clients.
No public exploits tracked yet. Mallory keeps watching.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.