{"id":"CVE-2026-73100","aliases":[],"cve":{"records":[{"id":"CVE-2026-73100","source":"apache","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-08-10T20:28:10.565Z","published":"2026-11-05T11:50:50.797Z","modified":"2026-11-05T11:50:50.797Z"}],"publishers":[{"name":"apache","role":"CNA","organizationId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","modified":"2026-11-05T11:50:50.797Z"}],"references":[{"url":"https://lists.apache.org/thread.html/j05q7vw08j48o96tdlzcsd4sozx1lyl6","tags":["vendor-advisory"],"source":"apache"}],"weaknesses":[{"id":"CWE-532","description":"CWE-532 Insertion of Sensitive Information into Log File","source":"apache"}],"applicability":[],"prioritization":[]},"title":"Apache Juneau: Sensitive request headers logged in cleartext by the default request logger on server errors","titleSource":"apache","descriptionSource":"apache","description":"Insertion of Sensitive Information into Log File vulnerability in Apache Juneau.\n\nThe default REST server call logger records request headers for requests that end in a server error, without redacting them. Any client able to cause a server error gets headers such as Authorization, Cookie, Proxy-Authorization and X-API-Key written in cleartext to the application log, exposing them to anyone who can read the logs.\n\nThis issue affects Apache Juneau: through 9.2.0.\n\nUsers are recommended to upgrade to version 9.2.1, which fixes the issue.","score":10,"severity":"critical","published":"2026-11-05T11:50:50.797Z","modified":"2026-11-05T11:50:50.797Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Apache Software Foundation","name":"Apache Juneau","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"9.2.1","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:maven/org.apache.juneau/juneau-rest-server","packageIdentity":{"ecosystem":"Maven","name":"org.apache.juneau:juneau-rest-server"},"cpes":[],"source":"apache","url":"https://www.cve.org/CVERecord?id=CVE-2026-73100"},{"vendor":"Apache Software Foundation","name":"Apache Juneau","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"9.2.1","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:maven/org.apache.juneau/juneau-rest-common","packageIdentity":{"ecosystem":"Maven","name":"org.apache.juneau:juneau-rest-common"},"cpes":[],"source":"apache","url":"https://www.cve.org/CVERecord?id=CVE-2026-73100"}],"remediation":[],"references":["https://lists.apache.org/thread.html/j05q7vw08j48o96tdlzcsd4sozx1lyl6"],"sources":[{"name":"CVE","id":"CVE-2026-73100","modified":"2026-11-05T11:50:50.797Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-73100"}],"assessments":[{"source":"apache","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","score":10}],"sourceAffected":[],"observedAt":"2026-11-05T12:44:23.711Z","kev":{"status":"not-listed","checkedAt":"2026-11-07T23:00:33.112Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-05T13:00:38.261Z","attemptedAt":"2026-11-05T13:00:38.261Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-05T13:00:37.603Z","attemptedAt":"2026-11-05T13:00:37.603Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-05T13:00:37.556Z","attemptedAt":"2026-11-05T13:00:37.556Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-05T13:00:36.745Z","attemptedAt":"2026-11-05T13:00:36.745Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-117409","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-117409","modified":"Nov 5, 2026, 11:50:50 AM","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","checkedAt":"2026-11-05T13:00:37.556Z"},{"source":"GitHub Advisory Database","id":"GHSA-h63v-gj7g-mx8j","url":"https://github.com/advisories/GHSA-h63v-gj7g-mx8j","modified":"2026-11-05T12:32:20Z","checkedAt":"2026-11-05T13:00:37.603Z"},{"source":"NVD","id":"CVE-2026-73100","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73100","modified":"2026-11-05T12:17:51.060","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-11-05T13:00:38.261Z"}],"aiSummary":{"text":"Apache Juneau through version 9.2.0 logs sensitive request headers in cleartext when a server error occurs, exposing them to log readers. An attacker must cause a server error to exploit this weakness. The impact is the exposure of sensitive information such as Authorization and Cookie headers.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-05T12:46:15.348Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-73100"}]}}