CVE-2026-59954: Apollo ConfigService Access Key Authentication Bypass Vulnerability
Summary
CVE-2026-59954: Apollo ConfigService access key authentication bypass via appId parsing and non-canonical matching. Affects com.ctrip.framework.apollo:apollo versions < 2.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apollo is a popular open-source configuration management tool used for managing application configurations in distributed systems. It provides features such as centralized configuration management, dynamic configuration updates, and support for multiple environments. The vulnerability in question arises from the way Apollo ConfigService handles appId authentication, potentially allowing unauthorized access to sensitive configuration data.
Vulnerability Detail
The vulnerability exists in Apollo ConfigService where it may allow unauthorized access to configuration data when AccessKey authentication is enabled. This occurs due to the service accepting non-canonical appId variants during authentication. If the extracted appId does not exactly match the AccessKey cache key, the ConfigService may treat the request as having no available secrets, allowing it to proceed without proper signature verification. This can lead to unauthorized users reading sensitive configuration data, especially when the database collation treats non-canonical appId variants as equivalent to the real appId.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, ensure that your database collation settings do not allow for non-canonical appId variants to be treated as equivalent to the real appId. This may involve adjusting collation settings or implementing additional validation checks in your application logic.
Conclusion
The CVE-2026-59954 vulnerability in Apollo ConfigService poses a significant risk by allowing unauthorized access to configuration data through appId parsing issues. Users are strongly advised to upgrade to version 2.5.2 or later to mitigate this risk. Additionally, implementing proper database collation settings can serve as a temporary workaround.
See every vulnerability recorded for com.ctrip.framework.apollo:apollo →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Versions of Apollo prior to 2.5.2 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check if your application is affected by visiting the Vulert playground at Vulert Scanner without any signup.
An unauthenticated remote attacker may gain access to sensitive configuration data, which could lead to further exploitation of the application.
Yes, you can adjust your database collation settings to prevent non-canonical appId variants from being treated as equivalent to the real appId as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.ctrip.framework.apollo:apollo.
