# CVE-2026-59955: Apollo ConfigService authentication bypass in raw configuration endpoint

Source: https://junglewise.ai/threats/cve-2026-59955-apollo-configservice-authentication-bypass-in-raw-configuration  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-15. Updated: 2026-07-15  
License: CC BY 4.0 with a link back

CVE-2026-59955 · Severity: high · CVSS 7.5 · Published 2026-07-15

Apollo is a configuration management system used to manage settings for microservices. A security flaw in the ConfigService component allows unauthorized users to bypass authentication and access raw configuration data. This could lead to the exposure of sensitive application secrets, database credentials, or internal system settings, potentially compromising the entire microservice environment.

Technologies: [ApolloConfig Apollo](https://junglewise.ai/threats/technologies/apollo), [com.ctrip.framework.apollo:apollo (Maven)](https://junglewise.ai/threats/technologies/com-ctrip-framework-apollo-apollo). Vendors: [ApolloConfig](https://junglewise.ai/threats/vendors/apolloconfig), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-59955 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59955 being exploited in the wild.

**How severe is CVE-2026-59955?** High severity, with a CVSS score of 7.5, published 15 July 2026.

**Which products and versions are affected?** ApolloConfig Apollo < 2.5.2; ApolloConfig Apollo ConfigService < 2.5.2; com.ctrip.framework.apollo:apollo (Maven) < 2.5.2, ECOSYSTEM:introduced=0.

**Is there a fix for CVE-2026-59955?** A patch was published on 2026-07-12: Version 2.5.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59955 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-59955?** Check whether you run ApolloConfig Apollo, ApolloConfig Apollo ConfigService or com.ctrip.framework.apollo:apollo (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An authentication bypass exists in Apollo ConfigService's handling of requests to the '/configfiles/raw/{appId}/{clusterName}/{namespace}' endpoint. The vulnerability stems from the service incorrectly parsing the string 'raw' as the appId for authentication purposes instead of extracting the actual appId from the URI path. Because the system looks up AccessKey secrets for the literal appId 'raw', it may find no associated secrets and proceed without requiring a valid signature, even if the target appId in the path requires authentication. An unauthenticated remote attacker can exploit this to retrieve raw configuration files. The issue is addressed in version 2.5.2 by ensuring the correct appId is validated during the authentication process.

## Affected products

- ApolloConfig Apollo ConfigService < 2.5.2

## Identifiers

- CVE-2026-59955
- GHSA-h4pc-58cc-hc95

## Timeline

- 2026-07-12: patched: Version 2.5.2 released
- 2026-07-15: disclosed: NVD publication date

## References

- [https://github.com/apolloconfig/apollo/commit/310809d557e01c6803051736cd525e333ffe00ec](https://github.com/apolloconfig/apollo/commit/310809d557e01c6803051736cd525e333ffe00ec)
- [https://github.com/apolloconfig/apollo/releases/tag/v2.5.2](https://github.com/apolloconfig/apollo/releases/tag/v2.5.2)
- [https://github.com/apolloconfig/apollo/security/advisories/GHSA-h4pc-58cc-hc95](https://github.com/apolloconfig/apollo/security/advisories/GHSA-h4pc-58cc-hc95)

## Related threats

- [apolloconfig Apollo ConfigService authentication bypass via appId mismatch](https://junglewise.ai/threats/cve-2026-59954-apolloconfig-apollo-configservice-authentication-bypass-via-appid)
- [Apollo Portal Authorization Bypass in Release Controller](https://junglewise.ai/threats/cve-2025-32781-apollo-portal-authorization-bypass-in-release-controller)
- [apollo-portal has potential unauthorized access issue](https://junglewise.ai/threats/cve-2024-43397-apollo-portal-has-potential-unauthorized-access-issue)
- [Apollo missing authentication in built-in Eureka service](https://junglewise.ai/threats/cve-2023-25570-apollo-missing-authentication-in-built-in-eureka-service)
- [apollo-portal has potential CSRF issue](https://junglewise.ai/threats/cve-2023-25569-apollo-portal-has-potential-csrf-issue)