Insertion of Sensitive Information into Log File vulnerability in Apache Answer. (CVE-2026-64943)
Description
Apache Answer versions through 2.0.2 have a vulnerability where full API keys are logged on every authenticated request. This allows anyone with access to the logs to retrieve and reuse active bearer credentials. The issue is fixed in version 2.0.3.
CVSS v3.1
Score 8.1high
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-64943 describes a vulnerability in Apache Answer up to version 2.0.2 where sensitive information, specifically full API keys, is inserted into application log files on every authenticated request. This exposure enables an attacker with log-read access to recover and replay bearer tokens, compromising confidentiality and integrity of the authentication process. The vulnerability is addressed by upgrading to version 2.0.3.
Potential Impact
Exposure of full API keys in logs allows unauthorized parties with log access to obtain active bearer credentials, leading to potential unauthorized access and impersonation within the affected system. The CVSS score of 8.1 (high) reflects the significant confidentiality and integrity impact without availability impact.
Mitigation Recommendations
Users should upgrade Apache Answer to version 2.0.3, which contains the official fix for this vulnerability. No other mitigation is indicated or required once the upgrade is applied.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-96wg-9jw8-3mxp
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64943"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6ad7ec242cdf04f6566b009b
Added to database: 10/20/2026, 22:33:08 UTC
Last enriched: 10/20/2026, 22:33:32 UTC
Last updated: 10/20/2026, 22:33:32 UTC
Views: 1
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.