CVE-2026-73100 in Juneau
Summary
by MITRE • 11/05/2026
Insertion of Sensitive Information into Log File vulnerability in Apache Juneau.
The default REST server call logger records request headers for requests that end in a server error, without redacting them. Any client able to cause a server error gets headers such as Authorization, Cookie, Proxy-Authorization and X-API-Key written in cleartext to the application log, exposing them to anyone who can read the logs.
This issue affects Apache Juneau: through 9.2.0.
Users are recommended to upgrade to version 9.2.1, which fixes the issue.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/05/2026
The vulnerability identified in Apache Juneau represents a critical failure in secure logging practices, specifically categorized under CWE-532 as Insertion of Sensitive Information into Log File. This flaw resides within the default REST server call logger component, which is designed to capture diagnostic information for troubleshooting purposes. However, the implementation fails to implement proper data sanitization or redaction mechanisms before writing request metadata to persistent storage. The core technical deficiency lies in the unconditional logging of HTTP headers associated with requests that result in a server-side error status code. When an application encounters an internal exception or unhandled error condition, it triggers this logger, which indiscriminately captures and writes all incoming header fields to the log file without filtering out authentication credentials or session tokens.
The operational impact of this vulnerability is severe due to the nature of HTTP headers in modern web applications. Headers such as Authorization, Cookie, Proxy-Authorization, and X-API-Key frequently contain bearer tokens, basic authentication credentials, session identifiers, and API keys that are essential for maintaining user identity and access control. By writing these values in cleartext to log files, any individual or process with read access to the server's file system can extract valid credentials. This effectively bypasses network-level security controls since the attacker does not need to intercept traffic on the wire; they only require local filesystem access, which is often less restricted than network segmentation policies suggest. In many deployment scenarios, log files are accessible by multiple services or administrators for monitoring and debugging purposes, thereby expanding the attack surface significantly beyond just the application process itself.
From a threat modeling perspective, this vulnerability aligns with ATT&CK technique T1078, Valid Accounts, as it facilitates unauthorized access through stolen credentials. It also relates to T1530, Data from Local System, since the attacker must first gain some level of file system access to read the logs. The exposure is particularly dangerous because log files are often archived or transmitted to centralized logging systems like ELK Stack or Splunk for analysis. If these central repositories do not have equally robust data masking policies, the sensitive information can be exfiltrated from a broader set of infrastructure components. This creates a persistent risk where compromised credentials remain valid until they are manually rotated by administrators who may not immediately realize that their secrets were exposed in plain text logs during routine error handling events.
The vulnerability affects Apache Juneau versions through 9.2.0, indicating a systemic issue in the default configuration of these releases. The recommended mitigation is to upgrade to version 9.2.1 or later, where this logging behavior has been corrected to redact sensitive header fields before persistence. In environments where upgrading is not immediately feasible, administrators should implement compensating controls such as configuring custom log appenders that explicitly filter out headers containing keywords like Authorization, Cookie, and API keys. Additionally, strict file system permissions should be enforced on log directories to ensure that only the application process can write logs and a minimal set of trusted services or users can read them. Regular auditing of log content for sensitive data patterns is also advised to detect any potential exposure from previous vulnerable versions before they are patched.