CVE-2026-59954 | Apollo is a reliable configuration management system suitabl… | CVSS 7.5 HIGH

Description

Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.2, Apollo ConfigService may allow unauthorized access to configuration data when AccessKey or management key authentication is enabled because ConfigService can accept a non-canonical appId variant during authentication while downstream request handling resolves it to the protected app, including accent variants under accent-insensitive collations or trailing-space variants under PAD SPACE collations on /configs and /configfiles endpoints. This issue is fixed in version 2.5.2.

Metadata

CVE ID: CVE-2026-59954
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-07-07 18:49 UTC
Published: 2026-07-15 16:27 UTC
Last updated: 2026-07-15 17:28 UTC
Primary CWE: CWE-20
CWE-20: Improper Input Validation
Vendor / Product: apolloconfig / apollo
Sources: cve.org · NVD

Severity & Metrics

7.5 HIGH CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
apolloconfig	apollo	—	< 2.5.2

Weakness (CWE)

CWE	Source	Description
CWE-20	cna	CWE-20: Improper Input Validation
CWE-287	cna	CWE-287: Improper Authentication

CVSS scores (1)

Score	Severity	Version	Source	Vector
7.5	HIGH	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References (3)

https://github.com/apolloconfig/apollo/security/advisories/GHSA-4w3q-qpfq-v992 https://github.com/apolloconfig/apollo/security/advisories/GHSA-4w3q-qpfq-v992
https://github.com/apolloconfig/apollo/commit/310809d557e01c6803051736cd525e333ffe00ec https://github.com/apolloconfig/apollo/commit/310809d557e01c6803051736cd525e333ffe00ec
https://github.com/apolloconfig/apollo/releases/tag/v2.5.2 https://github.com/apolloconfig/apollo/releases/tag/v2.5.2