{"id":"CVE-2026-71563","kind":"vulnerability","aliases":["CVE-2026-71563"],"related":[],"title":"Apache Answer: MCP tool leaks hidden or deleted question answers to API key holders","description":"Missing Authorization vulnerability in Apache Answer.\n\n\n\nThis issue affects Apache Answer: through 2.0.2.\n\nAn authorization flaw in the MCP answer retrieval tool allows holders of a global API key to access answer content associated with hidden, deleted, or pending-review questions.\n\n\nUsers are recommended to upgrade to version 2.0.3, which fixes the issue.","summary":"Apache Answer through 2.0.2 has a missing authorization check in its MCP answer retrieval tool. A holder of a global API key can read answer content tied to questions that are hidden, deleted, or pending review.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","apache-answer","mcp","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"- Check the installed Apache Answer version; affected releases are `2.0.2` and earlier.\n- Check whether the MCP server is enabled and whether any global API keys are issued.","fix":"- Upgrade Apache Answer to `2.0.3` or later.\n- Rotate global API keys if untrusted parties may have held them.","status":"open","published_at":"2026-10-19T10:16:48+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T04:39:42+00:00","updated_at":"2026-10-25T04:39:42+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-25T04:39:42Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache Answer to `2.0.3` or later.\n- Rotate global API keys if untrusted parties may have held them.","reach":"network","title":"Apache Answer: MCP tool leaks hidden or deleted question answers to API key holders","impact":"low","summary":"Apache Answer through 2.0.2 has a missing authorization check in its MCP answer retrieval tool. A holder of a global API key can read answer content tied to questions that are hidden, deleted, or pending review.","category":"ai-tooling","nicknames":[],"who_cares":["apache-answer","mcp","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"API key holder reads answers from hidden or deleted questions","analyst_note":"Confirm whether the MCP tool is enabled by default and whether the NVD entry has an upstream advisory with exact affected configuration.","how_to_check":"- Check the installed Apache Answer version; affected releases are `2.0.2` and earlier.\n- Check whether the MCP server is enabled and whether any global API keys are issued.","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Teams running Apache Answer through 2.0.2 with the MCP answer retrieval tool exposed to holders of global API keys. Installs without the MCP tool or without global API keys issued have a smaller exposure.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000591,"input_tokens":3323,"output_tokens":517,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-71563':17A,20A '2.0.2':34B,79C '2.0.3':116C 'access':97C 'affect':75C 'ai':22B 'ai-tool':21B 'allow':89C 'answer':2A,10A,26B,32B,43B,55B,72C,77C,86C,98C 'apach':1A,25B,31B,71C,76C 'apache-answ':24B 'api':12A,51B,94C 'associ':100C 'author':38B,68C,81C 'check':39B 'content':56B,99C 'cve':15A,18A 'delet':8A,63B,103C 'fix':118C 'flaw':82C 'global':50B,93C 'hidden':6A,62B,102C 'holder':14A,47B,90C 'host':30B 'issu':74C,120C 'key':13A,52B,95C 'leak':5A 'mcp':3A,27B,42B,85C 'miss':37B,67C 'pend':65B,106C 'pending-review':105C 'question':9A,59B,108C 'read':54B 'recommend':111C 'retriev':44B,87C 'review':66B,107C 'self':29B 'self-host':28B 'tie':57B 'tool':4A,23B,45B,88C 'upgrad':113C 'user':109C 'version':115C 'vulner':69C","nicknames":[],"mitigations":[],"who_affected":"Teams running Apache Answer through 2.0.2 with the MCP answer retrieval tool exposed to holders of global API keys. Installs without the MCP tool or without global API keys issued have a smaller exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T10:16:48+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-71563","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71563","severity":null,"published_at":"2026-10-19T10:16:48+00:00","modified_at":"2026-10-20T19:18:14+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}