Live › vulnerability › CVE-2026-64943
Go to dashboardApache Answer through 2.0.2 writes full API keys into application logs on every authenticated request. Anyone who can read those logs can recover active bearer tokens and replay them against the service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Apache Answer up to and including 2.0.2 that use API keys and keep request logs. Exposure depends on whether logs are readable by people or systems beyond the operators; teams on a newer release can skip it.
No product ranges from the sources yet.
2.0.2 or earliergrep -i "api_key\|authorization" <log files>2.0.3Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Insertion of Sensitive Information into Log File vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.2.
Full API keys are written to application logs on every authenticated request, allowing anyone with log-read access to recover and replay active bearer credentials.
Users are recommended to upgrade to version 2.0.3, which fixes the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-64943")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.