CVE-2026-71563: Apache Answer: MCP Answer Retrieval Exposes Content from Non-Public Questions

Q: Who can exploit this issue?

An attacker needs a global API key. With that key, they can use the MCP answer retrieval tool to access answer content tied to hidden, deleted, or pending-review questions.

Q: Which deployments are affected?

Apache Answer versions through 2.0.2 are affected. Version 2.0.3 fixes the authorization flaw.

Q: What should teams do if they cannot upgrade immediately?

The provided information identifies global API keys as the required access condition. Until upgrading, treat holders of those keys as able to retrieve answer content from non-public question states and restrict access to those keys accordingly.

Published Oct 16, 2026

Updated

Missing Authorization vulnerability in Apache Answer.

This issue affects Apache Answer: through 2.0.2.

An authorization flaw in the MCP answer retrieval tool allows holders of a global API key to access answer content associated with hidden, deleted, or pending-review questions.

Users are recommended to upgrade to version 2.0.3, which fixes the issue.

Affected Software

1 affected component

Apache Answer<=2.0.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache Answer to a version that resolves this vulnerability.
Fixed in 2.0.3

Event History

Oct 19, 2026

CVE Published

via MITRE·09:32 AM

Data Sourced

via MITRE·09:32 AM

DescriptionWeakness

Data Sourced

via NVD·10:16 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs a global API key. With that key, they can use the MCP answer retrieval tool to access answer content tied to hidden, deleted, or pending-review questions.

Which deployments are affected?

Apache Answer versions through 2.0.2 are affected. Version 2.0.3 fixes the authorization flaw.

What should teams do if they cannot upgrade immediately?

The provided information identifies global API keys as the required access condition. Until upgrading, treat holders of those keys as able to retrieve answer content from non-public question states and restrict access to those keys accordingly.

CVE-2026-71563: Apache Answer: MCP Answer Retrieval Exposes Content from Non-Public Questions

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Which deployments are affected?

What should teams do if they cannot upgrade immediately?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which deployments are affected?

What should teams do if they cannot upgrade immediately?