CVE-2026-71563: Apache Answer exposes answers to non-public questions through the MCP answer retrieval tool
A missing authorization flaw in Apache Answer up to version 2.0.2 lets holders of a global API key read answers to hidden, deleted or pending-review questions through the MCP answer retrieval tool. Moderate severity. Fixed in version 2.0.3.
The advisory was posted by Enxin Xie on October 15, 2026 to the oss-sec mailing list and is identified as CVE-2026-71563. According to the description, Apache Answer up to version 2.0.2 has a missing authorization check in its MCP answer retrieval tool. Holders of a global API key can access answer content tied to hidden, deleted or pending-review questions. The stated severity is moderate. The vendor recommends upgrading to version 2.0.3, which fixes the issue.
The source text is an automatic translation of the feed, so check the technical terms against the English post on the oss-sec list before acting on them. To find out whether your instance is affected, identify the installed Apache Answer version and confirm whether the MCP answer retrieval tool is enabled and reachable with the API keys in use.
This matters for privacy because hidden or deleted questions often contain sensitive information the author did not intend to publish. The flaw is in third-party software and Rota Nacional does not fix it. The platform does not host or modify Apache Answer, so the remedy depends on upgrading that software.