CVE-2026-73100
Last modified
CVE-2026-73100 is a critical-severity vulnerability rated 10/10 on the CVSS scale. Insertion of Sensitive Information into Log File vulnerability in Apache Juneau. The default REST server call logger records request headers for requests that end in a server error, without redacting them. Any client able to cause a server error gets headers such as Authorization, Cookie, Proxy-Authorization and X-API-Key written in cleartext to the application log, exposing them to anyone who can read the logs. This issue affects Apache Juneau: through 9.2.0. Users are recommended to upgrade to version 9.2.1, which fixes the issue..
Description
Insertion of Sensitive Information into Log File vulnerability in Apache Juneau. The default REST server call logger records request headers for requests that end in a server error, without redacting them. Any client able to cause a server error gets headers such as Authorization, Cookie, Proxy-Authorization and X-API-Key written in cleartext to the application log, exposing them to anyone who can read the logs. This issue affects Apache Juneau: through 9.2.0. Users are recommended to upgrade to version 9.2.1, which fixes the issue.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Juneau | < 9.2.1 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-73100?
How severe is CVE-2026-73100?
How do I fix CVE-2026-73100?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-7309A flaw was found in the OpenShift Container Platform build s…4.3
- CVE-2026-73090PeerTube is an ActivityPub-federated video streaming platfor…9.3
- CVE-2026-73095Allocation of Resources Without Limits or Throttling vulnera…8.7
- CVE-2026-73098Improper control of dynamically-loaded code vulnerability in…10
- CVE-2026-73099Cross-Site Request Forgery (CSRF) vulnerability in Apache Ju…10
- CVE-2026-7310A heap-based buffer overflow vulnerability exists in XML par…4.4
- CVE-2026-73101Generation of Error Message Containing Sensitive Information…10
- CVE-2026-73102RustDesk versions 1.3.9 through 1.4.9 contain a path travers…5.7
- CVE-2026-73103Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2026-73104Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2026-73105Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2026-73106Rejected reason: This CVE ID has been rejected or withdrawn …
Are you affected by CVE-2026-73100?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST