CVE-2026-64943

8.1High

Published 19 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

8.1High

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: High impact on confidentiality, integrity
Weakness: CWE-532

Impact

Attackers or internal users with read access to application logs can recover active bearer credentials to hijack user sessions. Exploitation requires existing access to Apache Answer application log files.

Root cause

The application writes full API keys directly to the application logs on every authenticated request.

Affected systems

Apache Answer through 2.0.2

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Fix & remediation

Upgrade to Apache Answer 2.0.3. If patching immediately is not possible, restrict file and streaming access to application logs and rotate existing API keys.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Insertion of Sensitive Information into Log File vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Full API keys are written to application logs on every authenticated request, allowing anyone with log-read access to recover and replay active bearer credentials. Users are recommended to upgrade to version 2.0.3, which fixes the issue.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-64943