CVE-2026-73100

CriticalCVSS 10.0/10Last modified Nov 10, 2026

Description

Insertion of Sensitive Information into Log File vulnerability in Apache Juneau.

The default REST server call logger records request headers for requests that end in a server error, without redacting them. Any client able to cause a server error gets headers such as Authorization, Cookie, Proxy-Authorization and X-API-Key written in cleartext to the application log, exposing them to anyone who can read the logs.

This issue affects Apache Juneau: through 9.2.0.

Users are recommended to upgrade to version 9.2.1, which fixes the issue.

Metrics

CVSS 4.0 10.0/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-532

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Juneau	< 9.2.1
Apache Software Foundation	Apache Juneau	< 9.2.1

References

https://lists.apache.org/thread.html/j05q7vw08j48o96tdlzcsd4sozx1lyl6

Timeline

Published: Nov 5, 2026
Last modified: Nov 10, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-7310110.0Generation of Error Message Containing Sensitive Information vulnerability in Apache Juneau. The REST server sends the internal exception c CVE-2026-731025.7RustDesk versions 1.3.9 through 1.4.9 contain a path traversal vulnerability in the macOS clipboard file-paste code path. The application ac CVE-2026-731087.5RustDesk versions before 1.4.7 contain an uncontrolled speculative memory allocation vulnerability in BytesCodec. Before authentication, the CVE-2026-73118.1The TinyPNG – JPEG, PNG & WebP image compression plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path CVE-2026-7311610.0Insufficiently Protected Credentials vulnerability in Apache Juneau. The Apache Juneau RestClient followed HTTP redirects while keeping cre CVE-2026-7311710.0Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability in Apache Juneau. The Apache Juneau RES CVE-2026-73127.5CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 14.0.7700 to 14.4.8152, and 15.0.8200 to 1 CVE-2026-731227.7A flaw was found in the multicloud-operators-channel component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows a c CVE-2026-731259.8Ebyte device web management interface does not consistently enforce authentication before granting access to administrative functionality. CVE-2026-731264.3Gitea's Actions workflow status badge endpoint does not enforce repository-read scope or the public-only restriction on the token authentica CVE-2026-73134.9CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 8.0.5700 to 13.3.7652 allows a remote auth CVE-2026-731304.3Gitea does not limit the length of the gitignores field accepted by repository-creation forms and the API. Repository initialization splits