https://seclists.org/oss-sec/2026/q4/197: CVE-2026-64943: Apache Answer: API keys logged in plaintext during authentication
Published Oct 16, 2026
·Updated
Affected Software
1 affected component
Apache Answer<=2.0.2
Anyone with read access to the application logs can recover full API keys and replay active bearer credentials. The issue occurs on every authenticated request, so log readers may obtain credentials used by authenticated users.
The provided information states that Apache Answer through 2.0.2 is affected and that API keys are written to application logs on every authenticated request. It does not identify any configuration prerequisite or exception.
Upgrade to Apache Answer 2.0.3, which fixes the logging issue. Because logged API keys can be replayed while active, treat keys present in accessible logs as exposed and replace them as appropriate.