CVE-2026-73099: Critical CSRF in Apache Juneau

CVE-2026-73099 describes a Cross-Site Request Forgery (CSRF) vulnerability in Apache Juneau's REST server. The flaw lies in the acceptance of a 'content' query parameter that replaces the request body, enabled by default on every HTTP method (GET, POST, PUT, DELETE). An attacker can exploit this behavior to direct victims to malicious links that deliver arbitrary requests to Juneau endpoints, bypassing CORS protections that rely on HTTP method or content-type instead of anti-CSRF tokens.

The vulnerability carries critical severity with a CVSS score of 10.0, the maximum rating. It was published to the NVD on November 5, 2026. Social media signals show four posts in the last 24 hours, indicating elevated community awareness. Apache Software Foundation has promptly released version 9.2.1 that fixes the issue.

IT administrators and CISOs must first verify whether Apache Juneau is present in production environments. For mitigation: immediately upgrade to version 9.2.1, or if immediate patching is not feasible, disable the content parameter by setting 'disableContentParam' to true. Additionally, verify CORS configuration and ensure anti-CSRF tokens are in use on all sensitive endpoints.