Vulnerability · Published Nov 5, 2026 · Assigned by apache

CVE-2026-73099Apache Juneau: Cross-site request forgery via default-enabled content query-parameter body override

Critical 10.0

In plain English

A critical-severity cross-site request forgery in Apache Juneau from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).

Severity (CVSS 4.0)10.0Critical

Exploit odds (30 days)0.2%top 88.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Cross-Site Request Forgery (CSRF) vulnerability in Apache Juneau. The REST server accepts a "content" query parameter that replaces the request body, and this is enabled by default on every HTTP method, including GET. A cross-site link can therefore deliver an attacker-chosen request body to an endpoint without a CORS preflight, defeating protections that rely on the HTTP method or content type instead of an anti-CSRF token. This issue affects Apache Juneau: through 9.2.0. Users are recommended to upgrade to version 9.2.1, which fixes the issue. Applications that do not use the content parameter can also set disableContentParam to true.

Affected products (as reported)

Vendor	Product	Versions
Apache Software Foundation	Apache Juneau	0 – before 9.2.1

Weakness: CWE-352 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

https://lists.apache.org/thread.html/j05q7vw08j48o96tdlzcsd4sozx1lyl6 vendor-advisory