Live › vulnerability › CVE-2026-71563
Go to dashboardApache Answer through 2.0.2 has a missing authorization check in its MCP answer retrieval tool. A holder of a global API key can read answer content tied to questions that are hidden, deleted, or pending review.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Apache Answer through 2.0.2 with the MCP answer retrieval tool exposed to holders of global API keys. Installs without the MCP tool or without global API keys issued have a smaller exposure.
No product ranges from the sources yet.
2.0.2 and earlier.2.0.3 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authorization vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.2.
An authorization flaw in the MCP answer retrieval tool allows holders of a global API key to access answer content associated with hidden, deleted, or pending-review questions.
Users are recommended to upgrade to version 2.0.3, which fixes the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-71563")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.