https://feed.craftedsignal.io/products/juneau--9.2.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 05 Nov 2026 16:32:24 +0000https://feed.craftedsignal.io/favicon-32x32.pnghttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svghttps://feed.craftedsignal.io/briefs/2026-11-apache-juneau-credential-exposure/Thu, 05 Nov 2026 16:32:24 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-apache-juneau-credential-exposure/Apache Juneau RestClient prior to version 9.2.1 contains a vulnerability where sensitive header information is forwarded across origins during HTTP redirects, enabling unauthorized credential interception.Apache Juneau RestClient (through version 9.2.0) incorrectly maintains sensitive credential headers (such as Authorization, Cookie, Proxy-Authorization, and X-API-Key) when following HTTP redirects. If a client is redirected by a server to a different host, port, or from HTTPS to HTTP, the RestClient may automatically leak these headers to the destination.

Impact

Successful exploitation allows a malicious or compromised server to intercept sensitive authentication tokens or cookies sent by the RestClient, facilitating account takeover or unauthorized access to backend services.

Recommendation

• Upgrade Apache Juneau to version 9.2.1 or later.
• If using a custom HttpClient, ensure that automatic redirects are disabled or that credential headers are explicitly stripped during cross-origin redirect events.

]]>criticaladvisoryhttps://feed.craftedsignal.io/briefs/2026-11-cve-2026-121489/Thu, 05 Nov 2026 16:32:16 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-cve-2026-121489/A critical path traversal vulnerability in Apache Juneau (versions 9.2.0 and earlier) allows unauthenticated remote attackers to read, write, or delete arbitrary files if specific DirectoryResource settings are enabled.Apache Juneau versions 9.2.0 and earlier are vulnerable to a path traversal vulnerability (CVE-2026-121489) in the DirectoryResource component. The vulnerability arises because the resource does not correctly validate request paths against the configured root directory. When the view, upload, or delete settings are enabled, an attacker can access, modify, or remove files anywhere the server process has permissions. The fix is available in Apache Juneau version 9.2.1.

Impact

Successful exploitation allows for unauthorized arbitrary file read, write, and delete operations on the server hosting the affected service. The vulnerability is rated with a CVSS 4.0 score of 10.0 (Critical).

Recommendation

• Upgrade Apache Juneau to version 9.2.1 or later immediately.
• Audit all DirectoryResource configurations in Juneau deployments; if the feature is not strictly required, disable the view, upload, and delete functionality.
• Review web server access logs for requests containing directory traversal sequences (e.g., '../') directed at the Juneau microservice endpoint.

]]>criticaladvisory