# CVE-2026-59954: apolloconfig Apollo ConfigService authentication bypass via appId mismatch

Source: https://junglewise.ai/threats/cve-2026-59954-apolloconfig-apollo-configservice-authentication-bypass-via-appid  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-15. Updated: 2026-07-15  
License: CC BY 4.0 with a link back

CVE-2026-59954 · Severity: high · CVSS 7.5 · Published 2026-07-15

Apollo is a configuration management system used to manage settings for microservices. A security flaw in the ConfigService component allows unauthorized users to bypass authentication and access sensitive configuration data. By using slightly modified application identifiers (such as adding spaces or accents), an attacker can trick the system into skipping security checks while still retrieving the protected configuration files.

Technologies: [ApolloConfig Apollo](https://junglewise.ai/threats/technologies/apollo), [com.ctrip.framework.apollo:apollo (Maven)](https://junglewise.ai/threats/technologies/com-ctrip-framework-apollo-apollo). Vendors: [ApolloConfig](https://junglewise.ai/threats/vendors/apolloconfig), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-59954 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59954 being exploited in the wild.

**How severe is CVE-2026-59954?** High severity, with a CVSS score of 7.5, published 15 July 2026.

**Which products and versions are affected?** ApolloConfig Apollo <= 2.0.1; ApolloConfig Apollo ConfigService < 2.5.2; com.ctrip.framework.apollo:apollo (Maven) <= 2.0.1, ECOSYSTEM:introduced=0,last_affected=2.0.1.

**Is there a fix for CVE-2026-59954?** A patch was published on 2026-07-12: Version 2.5.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59954 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-59954?** Check whether you run ApolloConfig Apollo, ApolloConfig Apollo ConfigService or com.ctrip.framework.apollo:apollo (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Apollo ConfigService prior to version 2.5.2 contains an authentication bypass vulnerability (CWE-287/CWE-20) affecting the /configs and /configfiles endpoints. When AccessKey or management key authentication is enabled, the service extracts the appId from the request to look up secrets; however, if a non-canonical variant is provided (e.g., trailing spaces or accent variants), the lookup fails to find a secret and may allow the request to proceed without signature verification. Because downstream database lookups often use collations (like PAD SPACE or accent-insensitive) that treat these variants as equivalent to the real appId, the attacker successfully retrieves the protected configuration. The issue is resolved in version 2.5.2 by strictly validating appId variants during the authentication phase.

## Affected products

- apolloconfig Apollo ConfigService < 2.5.2

## Identifiers

- CVE-2026-59954
- GHSA-4w3q-qpfq-v992

## Timeline

- 2026-07-12: patched: Version 2.5.2 released
- 2026-07-12: advisory: GitHub Security Advisory GHSA-4w3q-qpfq-v992 published
- 2026-07-15: disclosed: CVE-2026-59954 published to NVD

## References

- [https://github.com/apolloconfig/apollo/commit/310809d557e01c6803051736cd525e333ffe00ec](https://github.com/apolloconfig/apollo/commit/310809d557e01c6803051736cd525e333ffe00ec)
- [https://github.com/apolloconfig/apollo/releases/tag/v2.5.2](https://github.com/apolloconfig/apollo/releases/tag/v2.5.2)
- [https://github.com/apolloconfig/apollo/security/advisories/GHSA-4w3q-qpfq-v992](https://github.com/apolloconfig/apollo/security/advisories/GHSA-4w3q-qpfq-v992)

## Related threats

- [Apollo ConfigService authentication bypass in raw configuration endpoint](https://junglewise.ai/threats/cve-2026-59955-apollo-configservice-authentication-bypass-in-raw-configuration)
- [Apollo Portal Authorization Bypass in Release Controller](https://junglewise.ai/threats/cve-2025-32781-apollo-portal-authorization-bypass-in-release-controller)
- [apollo-portal has potential unauthorized access issue](https://junglewise.ai/threats/cve-2024-43397-apollo-portal-has-potential-unauthorized-access-issue)
- [Apollo missing authentication in built-in Eureka service](https://junglewise.ai/threats/cve-2023-25570-apollo-missing-authentication-in-built-in-eureka-service)
- [apollo-portal has potential CSRF issue](https://junglewise.ai/threats/cve-2023-25569-apollo-portal-has-potential-csrf-issue)