CVE-2026-59955: Apollo ConfigService Access Key Authentication Bypass Vulnerability
Summary
CVE-2026-59955: Apollo ConfigService access key authentication bypass via raw config file appId parsing. Affects com.ctrip.framework.apollo:apollo versions 1.0.0 – 2.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apollo is an open-source configuration management tool designed to help developers manage application configurations across different environments. It allows for centralized management of configurations, enabling teams to maintain consistency and control over application settings. The Apollo ConfigService component is responsible for serving configuration data to applications. However, a vulnerability has been identified that could allow unauthorized access to sensitive configuration data.
Vulnerability Detail
The vulnerability arises from a flaw in the authentication mechanism of Apollo ConfigService, specifically in how it parses the appId for raw configuration file requests. When a request is made to the endpoint /configfiles/raw/{appId}/{clusterName}/{namespace}, the service incorrectly interprets the appId as 'raw' instead of the intended application identifier. This misinterpretation can lead to situations where an attacker can bypass AccessKey management key authentication, allowing them to access raw configuration data without proper authorization. The potential ramifications include exposure of sensitive configuration data, which could lead to further exploitation or data breaches.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, if upgrading is not immediately feasible, consider restricting access to the ConfigService endpoints or implementing additional network security measures to prevent unauthorized access until the patch can be applied.
Conclusion
In summary, CVE-2026-59955 is a significant vulnerability in Apollo ConfigService that allows unauthorized access to raw configuration data due to a flaw in the authentication process. Users are strongly encouraged to upgrade to version 2.5.2 or later to mitigate this risk and protect sensitive information.
See every vulnerability recorded for com.ctrip.framework.apollo:apollo →
FAQ
CVE-2026-59955 is a vulnerability in Apollo ConfigService that allows unauthorized access to raw configuration data due to improper appId parsing.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can use the Vulert playground without signup to test your application.
The risks include unauthorized access to sensitive configuration data, which could lead to further exploitation or data breaches.
Yes, the vulnerability has been fixed in Apollo version 2.5.2. Users are advised to upgrade to this version or later.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.ctrip.framework.apollo:apollo.
