CVE-2026-59955
Received Received - Intake

Apollo ConfigService Unauthorized Raw Config Access

Publication date: 2026-07-15

Last updated on: 2026-07-15

Assigner: GitHub, Inc.

Description
Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.2, Apollo ConfigService may allow unauthorized access to raw configuration data when AccessKey or management key authentication is enabled because requests under /configfiles/raw/{appId}/{clusterName}/{namespace} are parsed for authentication as appId raw instead of the actual path appId, causing ConfigService to look up AccessKey secrets for raw before verifying the request signature and potentially continue without signature verification for the target appId. This issue is fixed in version 2.5.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-15
Last Modified
2026-07-15
Generated
2026-07-15
AI Q&A
2026-07-15
EPSS Evaluated
N/A
NVD
CVE-2026-59955
EUVD
EUVD-2026-44724

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
apollo configservice to 2.5.2 (exc)
apollo configservice 2.5.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Apollo ConfigService before version 2.5.2 has an authentication bypass vulnerability in the raw configuration file endpoint. When accessing /configfiles/raw/{appId}/{clusterName}/{namespace}, the system incorrectly parses the appId as 'raw' instead of the actual appId in the path. This allows unauthenticated users to bypass AccessKey or management key authentication and read raw configuration data if no AccessKey is configured for an application named 'raw'.

Impact Analysis

This vulnerability allows unauthorized access to sensitive configuration data stored in Apollo ConfigService. Attackers could read raw configuration files without proper authentication, potentially exposing secrets, API keys, database credentials, or other sensitive settings. The impact depends on the sensitivity of the data stored in the misconfigured applications.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, and other regulations by exposing sensitive personal or health data stored in configuration files. Unauthorized access to such data violates confidentiality requirements and may result in legal penalties, data breach notifications, and reputational damage.

Detection Guidance

Check Apollo ConfigService version to confirm if it is below 2.5.2. Inspect logs for unauthorized access attempts to /configfiles/raw/{appId}/{clusterName}/{namespace} endpoints. Monitor for requests where appId is parsed as 'raw' instead of the actual appId.

Mitigation Strategies

Upgrade Apollo ConfigService to version 2.5.2 or later. Deploy updates in order: apollo-configservice, apollo-adminservice, apollo-portal. Ensure no application named 'raw' exists to prevent bypass. Review and restrict access to raw configuration endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59955. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart