CVE-2026-73100: Credentials Logged in Plaintext in Apache Juneau

Juneau logs credentials unfiltered in error logs. Authorization, Cookie, X-API-Key exposed in plaintext.

CVE-2026-73100 is a vulnerability in Apache Juneau: the default logger records HTTP request headers in server errors (5xx) without redacting them. Authorization, Cookie, Proxy-Authorization, and X-API-Key are written in plaintext in logs, visible to anyone accessing log files (administrators, backups, monitoring).

CVSS score is 10.0 (maximum), severity critical. Apache has released the fix in version 9.2.1, published November 5, 2026 on NVD. Social media signals show moderate attention (3 posts in 24 hours with 4 interactions) without viral spread. No public exploits reported and no evidence of active exploitation in the wild.

For defenders: 1) Inventory Juneau systems and verify versions in production. 2) Upgrade to 9.2.1 as highest priority. 3) Audit historical logs (last 30–90 days) for Authorization, Cookie, X-API-Key in plaintext. 4) Rotate exposed credentials. 5) Restrict log access via RBAC and encryption at rest. 6) Enable redaction filters for sensitive headers.

At a glance

What: CVE-2026-73100: Apache Juneau's REST server logs HTTP request headers in error logs (5xx) without redacting them, exposing credentials like Authorization, Cookie, Proxy-Authorization, and X-API-Key in plaintext to anyone reading log files.
Severity: CVSS 10.0 - Critical. Any client triggering a server error causes credentials to be written to logs readable by administrators, monitoring processes, backups, and other systems with filesystem access.
Affected versions: Apache Juneau through version 9.2.0.
Fix: Upgrade to Apache Juneau 9.2.1 or later. The fix is already available from the vendor.
Status: Published on NVD on November 5, 2026. Fix available. No public exploits reported on known repositories. No evidence of active exploitation in the wild. Social signals: 3 posts in 24 hours, 4 total interactions.
Action: 1) Inventory Juneau systems and verify versions. 2) Plan upgrade to 9.2.1 as highest priority. 3) Audit historical logs (last 30–90 days) for Authorization, Cookie, X-API-Key in plaintext. 4) Rotate credentials if exposed. 5) Restrict log access via RBAC and encryption at rest. 6) Enable redaction filters for sensitive headers.

Sources: NVD, CVE-2026-73100

← All articles