CVE-2026-64943: Apache Answer: API keys logged in plaintext during authentication
Apache Answer through 2.0.2 logs full API keys in plaintext; 2.0.3 stops the leak.
Enxin Xie reported CVE-2026-64943, a low-severity information-disclosure flaw in Apache Answer through 2.0.2. Full API keys are written to application logs on every authenticated request. Anyone with log-read access can recover and replay active bearer credentials. Users are advised to upgrade to 2.0.3, which fixes the issue.
- Low-severity log leak in Apache Answer through 2.0.2.
- Full API keys are written to logs on every authenticated request.
- Anyone who can read logs can recover and replay bearer credentials.
- Version 2.0.3 is the recommended fix.
- CVEs
- CVE-2026-64943
- Vendors
- Apache Software Foundation
- Products
- Apache Answer
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-64943 | API keys written to logs in Apache Answer through 2.0.2 | 8.1 | — |
From the original article
Posted by Enxin Xie on Oct 15 Severity: low Affected versions: - Apache Answer through 2. 0. 2 Description: Insertion of Sensitive Information into Log File vulnerability in Apache Answer.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.