CVE-2026-64943: Apache Answer: API keys logged in plaintext during authentication

Q: Who can exploit the exposed credentials?

Anyone with read access to the application logs can recover full API keys and replay them as active bearer credentials. The issue is triggered by authenticated requests because their API keys are written to the logs.

Q: Which deployments are affected?

Apache Answer versions through 2.0.2 are affected. Version 2.0.3 fixes the logging behavior.

Q: What should be done if logs may have been exposed?

Upgrade to Apache Answer 2.0.3. Because logged API keys can be replayed, treat keys present in accessible application logs as exposed active credentials.

Published Oct 16, 2026

Updated

Insertion of Sensitive Information into Log File vulnerability in Apache Answer.

This issue affects Apache Answer: through 2.0.2.

Full API keys are written to application logs on every authenticated request, allowing anyone with log-read access to recover and replay active bearer credentials.

Users are recommended to upgrade to version 2.0.3, which fixes the issue.

Affected Software

1 affected component

Apache Answer<=2.0.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache Answer to a version that resolves this vulnerability.
Fixed in 2.0.3

Event History

Oct 19, 2026

CVE Published

via MITRE·09:26 AM

Data Sourced

via MITRE·09:26 AM

DescriptionWeakness

Data Sourced

via NVD·10:16 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit the exposed credentials?

Anyone with read access to the application logs can recover full API keys and replay them as active bearer credentials. The issue is triggered by authenticated requests because their API keys are written to the logs.

Which deployments are affected?

Apache Answer versions through 2.0.2 are affected. Version 2.0.3 fixes the logging behavior.

What should be done if logs may have been exposed?

Upgrade to Apache Answer 2.0.3. Because logged API keys can be replayed, treat keys present in accessible application logs as exposed active credentials.

CVE-2026-64943: Apache Answer: API keys logged in plaintext during authentication

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit the exposed credentials?

Which deployments are affected?

What should be done if logs may have been exposed?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit the exposed credentials?

Which deployments are affected?

What should be done if logs may have been exposed?