CVE-2026-59955 | Apollo is a reliable configuration management system suitabl… | CVSS 7.5 HIGH

Description

Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.2, Apollo ConfigService may allow unauthorized access to raw configuration data when AccessKey or management key authentication is enabled because requests under /configfiles/raw/{appId}/{clusterName}/{namespace} are parsed for authentication as appId raw instead of the actual path appId, causing ConfigService to look up AccessKey secrets for raw before verifying the request signature and potentially continue without signature verification for the target appId. This issue is fixed in version 2.5.2.

Metadata

CVE ID: CVE-2026-59955
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-07-07 18:49 UTC
Published: 2026-07-15 16:26 UTC
Last updated: 2026-07-15 18:11 UTC
Primary CWE: CWE-20
CWE-20: Improper Input Validation
Vendor / Product: apolloconfig / apollo
Sources: cve.org · NVD

Severity & Metrics

7.5 HIGH CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
apolloconfig	apollo	—	< 2.5.2

Weakness (CWE)

CWE	Source	Description
CWE-20	cna	CWE-20: Improper Input Validation
CWE-287	cna	CWE-287: Improper Authentication

CVSS scores (1)

Score	Severity	Version	Source	Vector
7.5	HIGH	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References (3)

https://github.com/apolloconfig/apollo/security/advisories/GHSA-h4pc-58cc-hc95 https://github.com/apolloconfig/apollo/security/advisories/GHSA-h4pc-58cc-hc95
https://github.com/apolloconfig/apollo/commit/310809d557e01c6803051736cd525e333ffe00ec https://github.com/apolloconfig/apollo/commit/310809d557e01c6803051736cd525e333ffe00ec
https://github.com/apolloconfig/apollo/releases/tag/v2.5.2 https://github.com/apolloconfig/apollo/releases/tag/v2.5.2