Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Insufficiently Protected Credentials vulnerability in Apache Juneau. The Apache Juneau RestClient followed HTTP redirects while keeping credential headers from the original request, so a server that redirected the client to a different host or port, or from HTTPS to HTTP, could receive headers such as Authorization, Cookie, Proxy-Authorization and X-API-Key. This issue affects Apache Juneau: through 9.2.0. Users are recommended to upgrade to version 9.2.1, which fixes the issue. The fix applies to HTTP clients created by the RestClient builder; applications that supply their own HttpClient must disable automatic redirects or strip credential headers on cross-origin redirects themselves.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
🆕 New CVEs Apache Software Foundation products: 8 critical CVEs Worst: path traversal in DirectoryResource (CVE-2026-121489) Patch → 9.2.1 https://cve.now/CVE-2026-121489?release=CVE-2026-73098,CVE-2026-73099,CVE-2026-73100,CVE-2026-73101,CVE-2026-73116,CVE-2026-73117,CVE-2026-96677&utm_source=x&utm_medium=social&utm_campaign=cvedotnow&utm_content=rollup
🆕 New CVE: CVE-2026-73116 (CVSS 10.0, Enclave score 3/10) Apache Juneau: REST client forwards credentials to a different origin when following HTTP redirects Remote, no login needed. Insufficiently Protected Credentials vulnerability in Apache Juneau. https://app.enclave.ai/threat-feed/CVE-2026-73116
CVE-2026-73116 · CRITICAL · CVSS 10.0 Apache Juneau through 9.2.0 has an Insufficiently Protected Credentials vulnerability. The RestClient forwards credentials to a different origin when following HTTP redirects. CVSS 4.0 · apache https://cve.new/CVE-2026-73116