---
id: "CVE-2026-64943"
kind: "vulnerability"
aliases: ["CVE-2026-64943"]
title: "Apache Answer: full API keys written to logs, enabling credential replay"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["apache-answer", "package", "self-hosted"]
not_affected_if: ["default-config"]
published_at: "2026-10-19T10:16:48+00:00"
first_seen_at: "2026-10-23T21:57:17+00:00"
updated_at: "2026-10-25T03:06:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64943", "first_seen_at": "2026-10-23T21:57:17+00:00"}]
---

# Apache Answer: full API keys written to logs, enabling credential replay

Apache Answer through 2.0.2 writes full API keys into application logs on every authenticated request. Anyone who can read those logs can recover active bearer tokens and replay them against the service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Apache Answer version and confirm whether it is `2.0.2` or earlier
- Search the application logs for bearer or API key values, for example with `grep -i "api_key\|authorization" <log files>`
- Review who has read access to the Answer log files and log storage

## Fix

- Upgrade Apache Answer to `2.0.3`
- Rotate any API keys that may have appeared in logs before the upgrade

## Timeline

- 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-64943

## From the sources

Insertion of Sensitive Information into Log File vulnerability in Apache Answer.



This issue affects Apache Answer: through 2.0.2.

Full API keys are written to application logs on every authenticated request, allowing anyone with log-read access to recover and replay active bearer credentials.


Users are recommended to upgrade to version 2.0.3, which fixes the issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_