https://seclists.org/oss-sec/2026/q4/197: CVE-2026-64943: Apache Answer: API keys logged in plaintext during authentication

Q: Who can exploit the exposed credentials?

Anyone with read access to the application logs can recover full API keys and replay active bearer credentials. The issue occurs on every authenticated request, so log readers may obtain credentials used by authenticated users.

Q: Are default deployments affected?

The provided information states that Apache Answer through 2.0.2 is affected and that API keys are written to application logs on every authenticated request. It does not identify any configuration prerequisite or exception.

Q: What should be done if affected logs may have been accessed?

Upgrade to Apache Answer 2.0.3, which fixes the logging issue. Because logged API keys can be replayed while active, treat keys present in accessible logs as exposed and replace them as appropriate.

Published Oct 16, 2026

Updated

Affected Software

1 affected component

Apache Answer<=2.0.2

Frequently Asked Questions

Who can exploit the exposed credentials?

Anyone with read access to the application logs can recover full API keys and replay active bearer credentials. The issue occurs on every authenticated request, so log readers may obtain credentials used by authenticated users.

Are default deployments affected?

The provided information states that Apache Answer through 2.0.2 is affected and that API keys are written to application logs on every authenticated request. It does not identify any configuration prerequisite or exception.

What should be done if affected logs may have been accessed?

Upgrade to Apache Answer 2.0.3, which fixes the logging issue. Because logged API keys can be replayed while active, treat keys present in accessible logs as exposed and replace them as appropriate.