CVE-2026-64943: Apache Answer: API keys logged in plaintext during authentication
Insertion of Sensitive Information into Log File vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.2.
Full API keys are written to application logs on every authenticated request, allowing anyone with log-read access to recover and replay active bearer credentials.
Users are recommended to upgrade to version 2.0.3, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Answerto a version that resolves this vulnerability.Fixed in 2.0.3
Event History
Frequently Asked Questions
Who can exploit the exposed credentials?
Anyone with read access to the application logs can recover full API keys and replay them as active bearer credentials. The issue is triggered by authenticated requests because their API keys are written to the logs.
Which deployments are affected?
Apache Answer versions through 2.0.2 are affected. Version 2.0.3 fixes the logging behavior.
What should be done if logs may have been exposed?
Upgrade to Apache Answer 2.0.3. Because logged API keys can be replayed, treat keys present in accessible application logs as exposed active credentials.