# CVE-2026-73116: Apache Juneau RestClient credential leakage on redirect

Source: https://junglewise.ai/threats/cve-2026-73116-insufficiently-protected-credentials-vulnerability-in-apache  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-05. Updated: 2026-11-05  
License: CC BY 4.0 with a link back

CVE-2026-73116 · Severity: info · Published 2026-11-05

Apache Juneau's RestClient is a library component used to make HTTP API calls from Java applications. When a server redirects an HTTP request to a different server or from HTTPS to HTTP, the library incorrectly forwards sensitive headers like Authorization, Cookie, and API keys to the new destination. An attacker controlling a server could exploit this to steal credentials meant for the original server.

Technologies: [Apache Juneau](https://junglewise.ai/threats/technologies/juneau). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-73116 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73116 being exploited in the wild.

**How severe is CVE-2026-73116?** Informational severity, published 5 November 2026.

**Which products and versions are affected?** Apache Juneau through 9.2.0.

**Is there a fix for CVE-2026-73116?** Yes: fixed in 9.2.1. Until then: Applications that supply their own HttpClient must disable automatic redirects or strip credential headers on cross-origin redirects themselves, rather than relying on the default RestClient builder behavior. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-73116 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-73116?** Check whether you run Apache Juneau at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 9.2.1

Applications that supply their own HttpClient must disable automatic redirects or strip credential headers on cross-origin redirects themselves, rather than relying on the default RestClient builder behavior.

## Technical details

The RestClient automatically follows HTTP redirects while preserving credential headers (Authorization, Cookie, Proxy-Authorization, X-API-Key) from the original request without checking if the redirect target is cross-origin or downgrades from HTTPS to HTTP. This is a credential leakage vulnerability affecting the redirect handling in the HTTP client builder. The fix in version 9.2.1 strips credential headers on cross-origin redirects; applications using custom HttpClient must implement this protection themselves.

## Affected products

- Apache Juneau through 9.2.0

## Timeline

- 2026-11-05: disclosed

## References

- [https://repo.maven.apache.org/maven2](https://repo.maven.apache.org/maven2)
- [https://lists.apache.org/thread.html/j05q7vw08j48o96tdlzcsd4sozx1lyl6](https://lists.apache.org/thread.html/j05q7vw08j48o96tdlzcsd4sozx1lyl6)

## Related threats

- [Apache Juneau cross-site scripting in HTML serialization](https://junglewise.ai/threats/cve-2026-96677-improper-neutralization-of-input-during-web-page-generation-cross)
- [Apache Juneau HTTP response splitting via unvalidated headers](https://junglewise.ai/threats/cve-2026-73117-improper-neutralization-of-crlf-sequences-in-http-headers-http)
- [Apache Juneau information disclosure in REST error responses](https://junglewise.ai/threats/cve-2026-73101-generation-of-error-message-containing-sensitive-information)
- [Apache Juneau sensitive information insertion in log file](https://junglewise.ai/threats/cve-2026-73100-insertion-of-sensitive-information-into-log-file-vulnerability-in)
- [Apache Juneau CSRF vulnerability via content query parameter](https://junglewise.ai/threats/cve-2026-73099-cross-site-request-forgery-csrf-vulnerability-in-apache-juneau)