{"id":"CVE-2026-64943","kind":"vulnerability","aliases":["CVE-2026-64943"],"related":[],"title":"Apache Answer: full API keys written to logs, enabling credential replay","description":"Insertion of Sensitive Information into Log File vulnerability in Apache Answer.\n\n\n\nThis issue affects Apache Answer: through 2.0.2.\n\nFull API keys are written to application logs on every authenticated request, allowing anyone with log-read access to recover and replay active bearer credentials.\n\n\nUsers are recommended to upgrade to version 2.0.3, which fixes the issue.","summary":"Apache Answer through 2.0.2 writes full API keys into application logs on every authenticated request. Anyone who can read those logs can recover active bearer tokens and replay them against the service.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-answer","package","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"- Check the installed Apache Answer version and confirm whether it is `2.0.2` or earlier\n- Search the application logs for bearer or API key values, for example with `grep -i \"api_key\\|authorization\" <log files>`\n- Review who has read access to the Answer log files and log storage","fix":"- Upgrade Apache Answer to `2.0.3`\n- Rotate any API keys that may have appeared in logs before the upgrade","status":"open","published_at":"2026-10-19T10:16:48+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T03:06:35+00:00","updated_at":"2026-10-25T03:06:35+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:06:35Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache Answer to `2.0.3`\n- Rotate any API keys that may have appeared in logs before the upgrade","reach":"local","title":"Apache Answer: full API keys written to logs, enabling credential replay","impact":"high","summary":"Apache Answer through 2.0.2 writes full API keys into application logs on every authenticated request. Anyone who can read those logs can recover active bearer tokens and replay them against the service.","category":"package","nicknames":[],"who_cares":["apache-answer","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker reads log files and replays active API keys to act as users","analyst_note":"","how_to_check":"- Check the installed Apache Answer version and confirm whether it is `2.0.2` or earlier\n- Search the application logs for bearer or API key values, for example with `grep -i \"api_key\\|authorization\" <log files>`\n- Review who has read access to the Answer log files and log storage","needs_analyst":false,"not_affected_if":["default-config"],"who_is_affected":"Teams running Apache Answer up to and including 2.0.2 that use API keys and keep request logs. Exposure depends on whether logs are readable by people or systems beyond the operators; teams on a newer release can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000576,"input_tokens":3331,"output_tokens":486,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-64943':14A,17A '2.0.2':28B,74C '2.0.3':108C 'access':93C 'activ':48B,98C 'affect':70C 'allow':87C 'answer':2A,20B,26B,67C,72C 'anyon':40B,88C 'apach':1A,19B,25B,66C,71C 'apache-answ':18B 'api':4A,31B,76C 'applic':34B,81C 'authent':38B,85C 'bearer':49B,99C 'credenti':10A,100C 'cve':12A,15A 'enabl':9A 'everi':37B,84C 'file':63C 'fix':110C 'full':3A,30B,75C 'host':24B 'inform':60C 'insert':57C 'issu':69C,112C 'key':5A,32B,77C 'log':8A,35B,45B,62C,82C,91C 'log-read':90C 'packag':21B 'read':43B,92C 'recommend':103C 'recov':47B,95C 'replay':11A,52B,97C 'request':39B,86C 'self':23B 'self-host':22B 'sensit':59C 'servic':56B 'token':50B 'upgrad':105C 'user':101C 'version':107C 'vulner':64C 'write':29B 'written':6A,79C","nicknames":[],"mitigations":[],"who_affected":"Teams running Apache Answer up to and including 2.0.2 that use API keys and keep request logs. Exposure depends on whether logs are readable by people or systems beyond the operators; teams on a newer release can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T10:16:48+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-64943","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64943","severity":null,"published_at":"2026-10-19T10:16:48+00:00","modified_at":"2026-10-20T19:17:39+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}