CVE-2026-73100Critical· 10.0▾ MidnightInsertion of Sensitive Information into Log File vulnerability in Apache Juneau. The default REST server call logger records request headers for requests that end in a server error, without redacting them. Any client able to cause a ser…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 55 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Insertion of Sensitive Information into Log File vulnerability in Apache Juneau.
The default REST server call logger records request headers for requests that end in a server error, without redacting them. Any client able to cause a server error gets headers such as Authorization, Cookie, Proxy-Authorization and X-API-Key written in cleartext to the application log, exposing them to anyone who can read the logs.
This issue affects Apache Juneau: through 9.2.0.
Users are recommended to upgrade to version 9.2.1, which fixes the issue.
org.apache.juneau:juneau-rest-server < 9.2.1org.apache.juneau:juneau-rest-common < 9.2.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-73117Critical· 10.0Apache Juneau: Response header CRLF injection and open redirect when applications set headers or redirect targets from request data
CVE-2026-64943High· 8.1Apache Answer: API keys logged in plaintext during authentication
CVE-2026-85260Medium· 5.5Apache Camel: Camel-MLLP Protected Health Information Disclosure to Logs by Default
CVE-2026-103371High· 7.5Insertion of Sensitive Information into Log File in Apache Geode Web Management. This issue affects Apache Geode: from 2.0.0 before 2.0.3. Users are recommended to upgrade to version 2.0.3, which fixes the issue.
CVE-2026-78242Medium· 5.7Insertion of sensitive information into log file vulnerability in Apache APISIX. This vulnerability can cause the unmasked header value to be written to the log sink under a certain response structure. This issue affects Apache AP…
CVE-2026-82434Medium· 6.5Description When ZooKeeper authentication is configured, Storm deliberately retains `storm.zookeeper.topology.auth.payload` in the topology configuration, because workers need it