CVE-2026-71563: Apache Answer: MCP Answer Retrieval Exposes Content from Non-Public Questions
Missing Authorization vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.2.
An authorization flaw in the MCP answer retrieval tool allows holders of a global API key to access answer content associated with hidden, deleted, or pending-review questions.
Users are recommended to upgrade to version 2.0.3, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Answerto a version that resolves this vulnerability.Fixed in 2.0.3
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs a global API key. With that key, they can use the MCP answer retrieval tool to access answer content tied to hidden, deleted, or pending-review questions.
Which deployments are affected?
Apache Answer versions through 2.0.2 are affected. Version 2.0.3 fixes the authorization flaw.
What should teams do if they cannot upgrade immediately?
The provided information identifies global API keys as the required access condition. Until upgrading, treat holders of those keys as able to retrieve answer content from non-public question states and restrict access to those keys accordingly.