CVE-2026-59954: apolloconfig Apollo ConfigService authentication bypass via appId mismatch

CVE-2026-59954 · Severity: high · CVSS 7.5 · Published 2026-07-15

Apollo is a configuration management system used to manage settings for microservices. A security flaw in the ConfigService component allows unauthorized users to bypass authentication and access sensitive configuration data. By using slightly modified application identifiers (such as adding spaces or accents), an attacker can trick the system into skipping security checks while still retrieving the protected configuration files.

Technologies: ApolloConfig Apollo, com.ctrip.framework.apollo:apollo (Maven). Vendors: ApolloConfig, Maven.

Quick answers

Is CVE-2026-59954 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-59954 being exploited in the wild.
How severe is CVE-2026-59954?
High severity, with a CVSS score of 7.5, published 15 July 2026.
Which products and versions are affected?
ApolloConfig Apollo <= 2.0.1; ApolloConfig Apollo ConfigService < 2.5.2; com.ctrip.framework.apollo:apollo (Maven) <= 2.0.1, ECOSYSTEM:introduced=0,last_affected=2.0.1.
Is there a fix for CVE-2026-59954?
A patch was published on 2026-07-12: Version 2.5.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59954 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-59954?
Check whether you run ApolloConfig Apollo, ApolloConfig Apollo ConfigService or com.ctrip.framework.apollo:apollo (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Apollo ConfigService prior to version 2.5.2 contains an authentication bypass vulnerability (CWE-287/CWE-20) affecting the /configs and /configfiles endpoints. When AccessKey or management key authentication is enabled, the service extracts the appId from the request to look up secrets; however, if a non-canonical variant is provided (e.g., trailing spaces or accent variants), the lookup fails to find a secret and may allow the request to proceed without signature verification. Because downstream database lookups often use collations (like PAD SPACE or accent-insensitive) that treat these variants as equivalent to the real appId, the attacker successfully retrieves the protected configuration. The issue is resolved in version 2.5.2 by strictly validating appId variants during the authentication phase.

Affected products

  • apolloconfig Apollo ConfigService < 2.5.2

Identifiers

  • CVE-2026-59954
  • GHSA-4w3q-qpfq-v992

Timeline

  • 2026-07-12: patched: Version 2.5.2 released
  • 2026-07-12: advisory: GitHub Security Advisory GHSA-4w3q-qpfq-v992 published
  • 2026-07-15: disclosed: CVE-2026-59954 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.