Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

Apache Juneau allows forged requests via content parameter

CVE-2026-73099 · published 4 days ago
Summary

Apache Juneau versions up to 9.2.0 let a specially crafted URL replace the request body, even on GET requests. This means an attacker could cause a user’s browser to send unwanted actions without needing a special token. Upgrade to version 9.2.1 or disable the content parameter in the configuration to stop this behavior.

What to do
  • Update apache software foundation apache juneau to version 9.2.1 or later.
Affected software
VendorProductAffected versions
apache software foundation apache juneau < 9.2.1
Original advisory text
Apache Juneau: Cross-site request forgery via default-enabled content query-parameter body override
Cross-Site Request Forgery (CSRF) vulnerability in Apache Juneau.

The REST server accepts a "content" query parameter that replaces the request body, and this is enabled by default on every HTTP method, including GET. A cross-site link can therefore deliver an attacker-chosen request body to an endpoint without a CORS preflight, defeating protections that rely on the HTTP method or content type instead of an anti-CSRF token.

This issue affects Apache Juneau: through 9.2.0.

Users are recommended to upgrade to version 9.2.1, which fixes the issue. Applications that do not use the content parameter can also set disableContentParam to true.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
10.0 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-352Cross-Site Request Forgery (CSRF)
Timeline
Published5 Nov 2026
Updated6 Nov 2026
First seen5 Nov 2026
Sources
CVE-2026-73099 · NVD
CVE-2026-73099 · MITRE
Track software like this
Free during beta