{"metadata": {"vulnerability": "CVE-2026-73116", "count": 14, "kinds": {"milestone": 4, "sighting": 5, "kev": 0, "other": 5}}, "data": [{"timestamp": "2026-08-10T21:14:20.996Z", "date_only": false, "value": "2026-08-10T21:14:20.996Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-73116", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-05T11:53:52.274Z", "date_only": false, "value": "2026-11-05T11:53:52.274Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-73116", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-05T11:53:52.274Z", "date_only": false, "value": "2026-11-05T11:53:52.274Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-73116", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-05T11:53:52.274Z", "date_only": false, "value": "2026-11-05T11:53:52.274Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / apache", "record": "CVE-2026-73116", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-05T11:59:34.229Z", "date_only": false, "value": "2026-11-05T11:59:34.229397Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117563717948246907", "record": "CVE-2026-73116", "field": "creation_timestamp", "uuid": "c567f914-ef6b-4c68-8f68-cb06e96f67a0", "content": "CVE-2026-73116 Apache Juneau: REST client forwards credentials to a different origin when following HTTP redirects Insufficiently Protected Credentials vulnerability in Apache Juneau.\nThe Apache Juneau RestClient followed HTTP redirects while keeping credential headers from the original request, so a server that redirected the client to a different host or port, or from HTTPS to HTTP, could receive headers such as Authorization, Cookie, Proxy-Authorization and X-API-Key.\nThis issue affects Apache Juneau: through 9.2.0.\nUsers are recommended to upgrade to version 9.2.1, which fixes the issue. The fix applies to HTTP clients created by the RestClient builder; applications that supply their own HttpClient must disable automatic redirects or strip credential headers on cross-origin redirects themselves.\nhttps://www.cve.org/CVERecord?id=CVE-2026-73116https://lists.apache.org/thread.html/j05q7vw08j48o96tdlzcsd4sozx1lyl6#apache #ApacheSoftwareFoundation #ApacheJuneau#CVE_2026_73116#bot", "url": "https://infosec.exchange/users/cve/statuses/117563717948246907"}, {"timestamp": "2026-11-05T12:17:51Z", "date_only": false, "value": "2026-11-05T12:17:51Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-X4M5-G65W-956P", "record": "GHSA-X4M5-G65W-956P", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-05T12:17:51.333Z", "date_only": false, "value": "2026-11-05T12:17:51.333", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-73116", "record": "FKIE_CVE-2026-73116", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-05T12:32:14Z", "date_only": false, "value": "2026-11-05T12:32:14Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-X4M5-G65W-956P", "record": "GHSA-X4M5-G65W-956P", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-05T12:32:14Z", "date_only": false, "value": "2026-11-05T12:32:14Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-X4M5-G65W-956P", "record": "GHSA-X4M5-G65W-956P", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-05T12:50:03.420Z", "date_only": false, "value": "2026-11-05T12:50:03.420475Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mzkvrm4y4q24", "record": "CVE-2026-73116", "field": "creation_timestamp", "uuid": "4e67b053-1317-4a0d-b1c2-ad3ba0fe9bbe", "content": "CVE-2026-73116 - apache juneau\nThe RestClient component in Apache Juneau versions up to 9.2.0 can follow a web redirect and keep authentication information such as passwords or session cookies,\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#apachejuneau #apachefoundation #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mzkvrm4y4q24"}, {"timestamp": "2026-11-05T13:00:35.865Z", "date_only": false, "value": "2026-11-05T13:00:35.865966Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aiuto-ch.bsky.social/post/3mzkweferjgi7", "record": "CVE-2026-73116", "field": "creation_timestamp", "uuid": "3f2bf21b-858c-440c-8c89-1c077fcdd6df", "content": "CVE Radar | CVE-2026-73116 | CVSS 10.0\n\nApache Juneau Redirect Credential Exposure\n\nCVE-2026-73116 is a critical insufficiently protected credentials vulnerability in Apache Juneau.\n\nFull analysis: https://t.me/aiutocomputerhelp_lab/1382", "url": "https://bsky.app/profile/aiuto-ch.bsky.social/post/3mzkweferjgi7"}, {"timestamp": "2026-11-05T13:47:28.484Z", "date_only": false, "value": "2026-11-05T13:47:28.484130Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/h7c2cx6wufkrz", "record": "CVE-2026-73116", "field": "creation_timestamp", "uuid": "e237be77-0bc8-46e3-8124-eac4f8082e12", "content": "CVE-2026-73116 - Apache Juneau: REST client forwards credentials to a different origin when following HTTP redirects\nCVE ID : CVE-2026-73116\n \n Published : Nov. 5, 2026, 12:17 p.m. | 50\u00a0minutes ago\n \n Description : Insufficiently Protected Credentials vulnerability in Apache J...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/h7c2cx6wufkrz"}, {"timestamp": "2026-11-05T14:07:56.732Z", "date_only": false, "value": "2026-11-05T14:07:56.732765Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mzl24vbbat2z", "record": "CVE-2026-73116", "field": "creation_timestamp", "uuid": "4f731c82-a41c-4cb9-9552-a7e653edbc87", "content": "\ud83d\udea8 CVE-2026-73116 \u2014 CVSS 10 CRITICAL\n\nInsufficiently Protected Credentials vulnerability in Apache Juneau. The Apache Juneau RestClient followed ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-73116\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mzl24vbbat2z"}, {"timestamp": "2026-11-05T15:01:29.553Z", "date_only": false, "value": "2026-11-05T15:01:29.553", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-73116", "record": "FKIE_CVE-2026-73116", "field": "lastModified", "linked_record": true}], "metrics": {"as_of": "2026-11-08T06:58:28.351Z", "anchors": {"origin": {"timestamp": "2026-11-05T11:53:52.274Z", "date_only": false, "value": "2026-11-05T11:53:52.274Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-73116", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-05T11:53:52.274Z", "date_only": false, "value": "2026-11-05T11:53:52.274Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-73116", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 241476.077877, "hours": 67.07668829916666, "days": 2.794862012465278, "min_seconds": 241476.077877, "max_seconds": 241476.077877, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-05T11:53:52.274Z", "date_only": false, "value": "2026-11-05T11:53:52.274Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-73116", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-08T06:58:28.351Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}