{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aapachejuneau/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:apache:juneau:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-73116"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Juneau (\u003c= 9.2.0)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Apache"],"content_html":"\u003cp\u003eApache Juneau RestClient (through version 9.2.0) incorrectly maintains sensitive credential headers (such as Authorization, Cookie, Proxy-Authorization, and X-API-Key) when following HTTP redirects. If a client is redirected by a server to a different host, port, or from HTTPS to HTTP, the RestClient may automatically leak these headers to the destination.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows a malicious or compromised server to intercept sensitive authentication tokens or cookies sent by the RestClient, facilitating account takeover or unauthorized access to backend services.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Apache Juneau to version 9.2.1 or later.\u003c/li\u003e\n\u003cli\u003eIf using a custom HttpClient, ensure that automatic redirects are disabled or that credential headers are explicitly stripped during cross-origin redirect events.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-05T16:32:24Z","date_published":"2026-11-05T16:32:24Z","id":"https://feed.craftedsignal.io/briefs/2026-11-apache-juneau-credential-exposure/","summary":"Apache Juneau RestClient prior to version 9.2.1 contains a vulnerability where sensitive header information is forwarded across origins during HTTP redirects, enabling unauthorized credential interception.","title":"Apache Juneau: Credential exposure via RestClient HTTP redirects (CVE-2026-73116)","url":"https://feed.craftedsignal.io/briefs/2026-11-apache-juneau-credential-exposure/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:apache:juneau:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-121489"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Juneau (\u003c= 9.2.0)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Apache"],"content_html":"\u003cp\u003eApache Juneau versions 9.2.0 and earlier are vulnerable to a path traversal vulnerability (CVE-2026-121489) in the DirectoryResource component. The vulnerability arises because the resource does not correctly validate request paths against the configured root directory. When the view, upload, or delete settings are enabled, an attacker can access, modify, or remove files anywhere the server process has permissions. The fix is available in Apache Juneau version 9.2.1.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for unauthorized arbitrary file read, write, and delete operations on the server hosting the affected service. The vulnerability is rated with a CVSS 4.0 score of 10.0 (Critical).\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Apache Juneau to version 9.2.1 or later immediately.\u003c/li\u003e\n\u003cli\u003eAudit all DirectoryResource configurations in Juneau deployments; if the feature is not strictly required, disable the view, upload, and delete functionality.\u003c/li\u003e\n\u003cli\u003eReview web server access logs for requests containing directory traversal sequences (e.g., '../') directed at the Juneau microservice endpoint.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-05T16:32:16Z","date_published":"2026-11-05T16:32:16Z","id":"https://feed.craftedsignal.io/briefs/2026-11-cve-2026-121489/","summary":"A critical path traversal vulnerability in Apache Juneau (versions 9.2.0 and earlier) allows unauthenticated remote attackers to read, write, or delete arbitrary files if specific DirectoryResource settings are enabled.","title":"Apache Juneau: Path traversal vulnerability (CVE-2026-121489)","url":"https://feed.craftedsignal.io/briefs/2026-11-cve-2026-121489/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:apache:juneau:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}