CVE-2026-59954
Deferred Deferred - Pending Action

Apollo ConfigService Unauthorized Access via Non-Canonical appId

Publication date: 2026-07-15

Last updated on: 2026-07-15

Assigner: GitHub, Inc.

Description
Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.2, Apollo ConfigService may allow unauthorized access to configuration data when AccessKey or management key authentication is enabled because ConfigService can accept a non-canonical appId variant during authentication while downstream request handling resolves it to the protected app, including accent variants under accent-insensitive collations or trailing-space variants under PAD SPACE collations on /configs and /configfiles endpoints. This issue is fixed in version 2.5.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-15
Last Modified
2026-07-15
Generated
2026-08-05
AI Q&A
2026-07-15
EPSS Evaluated
2026-08-03
NVD
CVE-2026-59954
EUVD
EUVD-2026-44725

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apollo configservice 2.5.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Apollo ConfigService versions before 2.5.2 allow unauthorized access to configuration data when AccessKey or management key authentication is enabled. The issue occurs because ConfigService accepts non-canonical variants of appId during authentication, such as accent-insensitive or trailing-space variants, while downstream handling resolves them to the protected appId. This mismatch enables attackers to bypass authentication and read sensitive configuration data from /configs and /configfiles endpoints.

Detection Guidance

To detect this vulnerability, check if your Apollo ConfigService version is 2.5.1 or earlier. Run: curl -s http://<apollo-configservice-host>:<port>/systemInfo | grep version. If the version is <=2.5.1, the system is vulnerable.

Impact Analysis

This vulnerability allows remote attackers to read sensitive configuration data without authentication. If you use Apollo ConfigService with AccessKey or management key authentication enabled, an attacker could exploit this to access protected configuration files, potentially exposing secrets, API keys, or other sensitive data stored in your configurations.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. If configuration data includes personal or health information, the breach could result in non-compliance, legal penalties, and reputational damage. Upgrading to Apollo 2.5.2 or later is necessary to mitigate these risks.

Mitigation Strategies

Upgrade Apollo ConfigService to version 2.5.2 or later. Deploy the new executables in this order: apollo-configservice, apollo-adminservice, apollo-portal. Verify the upgrade by checking the version again.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59954. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart