Inclusion of Sensitive Information in Log Files in Apache Answer - CVE-2026-64943
Published: October 22, 2026
Vulnerability identifier: #VU157267
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-64943
CWE-ID: CWE-532
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to recover active API keys from application logs and replay them to gain unauthorized API access.
The vulnerability exists due to insertion of sensitive information into log files in Apache Answer's authentication logging when processing authenticated requests. A local user can read full API keys recorded in application logs and replay these bearer credentials to access the API with the permissions associated with the exposed keys.
Affected software
Apache Answer
How to mitigate CVE-2026-64943
Install security update from vendor's website.
Apache Answer - update to 2.0.3