Apache Juneau: Credential exposure via RestClient HTTP redirects (CVE-2026-73116)
Apache Juneau RestClient prior to version 9.2.1 contains a vulnerability where sensitive header information is forwarded across origins during HTTP redirects, enabling unauthorized credential interception.
CVE search metadata
CVE search record: CVE-2026-73116. KEV: no. Product: Juneau (<= 9.2.0). Brief: Apache Juneau: Credential exposure via RestClient HTTP redirects (CVE-2026-73116). Brief link: https://feed.craftedsignal.io/briefs/2026-11-apache-juneau-credential-exposure/
Triage facts
Revision 1- Applicability
- Juneau (<= 9.2.0)
- Evidence
- Unknown
- Severity
- Critical
- Action
- Immediate escalation
- Sources
- 3 public sources
- Freshness
- Revision 1Nov 5, 16:32 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- B2Likely
Apache Juneau RestClient (through version 9.2.0) incorrectly maintains sensitive credential headers (such as Authorization, Cookie, Proxy-Authorization, and X-API-Key) when following HTTP redirects. If a client is redirected by a server to a different host, port, or from HTTPS to HTTP, the RestClient may automatically leak these headers to the destination.
Impact
Successful exploitation allows a malicious or compromised server to intercept sensitive authentication tokens or cookies sent by the RestClient, facilitating account takeover or unauthorized access to backend services.
Recommendation
- Upgrade Apache Juneau to version 9.2.1 or later.
- If using a custom HttpClient, ensure that automatic redirects are disabled or that credential headers are explicitly stripped during cross-origin redirect events.
Immediate actions
Inventory applications utilizing Apache Juneau RestClient and upgrade to 9.2.1.
Threat Hunt
Identify outbound HTTP traffic from servers using Apache Juneau where HTTP status codes indicate 301/302 redirects to different hostnames.
Data: Proxy/WAF logs, Application egress logs
Mitigations
Upgrade Apache Juneau to 9.2.1 or implement custom HttpClient logic to strip sensitive headers on cross-origin redirects.
CVE-2026-73116