CVE-2026-59954
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
Apollo ConfigService prior to version 2.5.2 may allow unauthorized access to configuration data when AccessKey or management key authentication is enabled. This occurs because ConfigService accepts non-canonical appId variants (e.g., accent or trailing-space variants) during authentication, which are later resolved to the protected app on /configs and /configfiles endpoints.
Risk Assessment
The organization is at risk of leaking sensitive configuration data, potentially leading to security breaches in microservice environments and unauthorized access to critical information.
Recommendation
Upgrade Apollo to version 2.5.2 or later immediately to fix the vulnerability and prevent unauthorized access.
Other vulnerabilities in Apollo
See all- CVE-2026-59955High
Apollo ConfigService before version 2.5.2 may allow unauthorized access to raw configuration data when AccessKey or management key authentication is enabled. The issue stems from incorrect parsing of the request path /configfiles/raw/{appId}/{clusterName}/{namespace}, where the application ID is read as 'raw' instead of the actual value from the URL, potentially bypassing signature verification for the target application.
- CVE-2025-32781Medium
In Apollo Portal prior to version 2.5.0, a vulnerability exists due to missing permission checks for applications and namespaces when fetching a release by its ID. An authenticated low-privileged user can read configuration data from other applications if they know or guess a valid releaseId, bypassing the UserPermissionValidator.shouldHideConfigToCurrentUser(...) mechanism.
Original NVD description (English source)
Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.2, Apollo ConfigService may allow unauthorized access to configuration data when AccessKey or management key authentication is enabled because ConfigService can accept a non-canonical appId variant during authentication while downstream request handling resolves it to the protected app, including accent variants under accent-insensitive collations or trailing-space variants under PAD SPACE collations on /configs and /configfiles endpoints. This issue is fixed in version 2.5.2.