What is the CVSS score of CVE-2026-59954?

CVE-2026-59954 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.5%.

Which versions of Apollo ConfigService are affected by CVE-2026-59954?

Apollo ConfigService, used to manage application settings and credentials across enterprise infrastructure, is vulnerable to unauthorized credential exposure.. A patch is available.

How to fix or mitigate CVE-2026-59954?

Within 24 hours: enumerate all Apollo ConfigService instances and assess network exposure; identify which configurations store secrets or sensitive credentials; apply firewall and security group rules to restrict access to trusted networks only. Within 7 days: assume all stored credentials may be compromised and execute credential rotation across all affected configurations (database passwords, API keys, integration secrets); audit ConfigService access logs for the /configs and /configfiles endpoints to detect unauthorized access attempts; review application logs for suspicious requests using non-canonical application identifiers. Within 30 days: implement persistent defensive controls including a reverse proxy or API gateway requiring additional authentication; establish real-time monitoring and alerting for unusual access patterns; coordinate with Ctrip/vendor regarding patch availability and deployment timeline.

Apollo ConfigService CVE-2026-59954

EUVD-2026-44725 HIGH

Improper Input Validation (CWE-20)

2026-07-13 https://github.com/apolloconfig/apollo

GHSA-4w3q-qpfq-v992

Canonical Authentication Bypass

7.5

CVSS 3.1 · Vendor: https://github.com/apolloconfig/apollo

Severity by source

Vendor (https://github.com/apolloconfig/apollo) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.9 MEDIUM

Network and unauthenticated (AV:N/PR:N), but AC:H because success depends on a non-default equivalence-treating DB collation and knowing the appId; confidentiality-only read (C:H, I:N/A:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/apolloconfig/apollo).

CVSS VectorVendor: https://github.com/apolloconfig/apollo

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 15, 2026 - 21:18 EUVD

Source Code Evidence Fetched

Jul 13, 2026 - 19:24 vuln.today

Analysis Generated

Jul 13, 2026 - 19:24 vuln.today

CVE Published

Jul 13, 2026 - 18:26 github-advisory

HIGH 7.5

DescriptionCVE.org

Summary

Apollo ConfigService may allow unauthorized access to configuration data when AccessKey / management key authentication is enabled and ConfigService accepts a non-canonical appId variant during authentication while downstream request handling resolves it to the protected app.

Details

ConfigService extracts appId from configuration and notification requests and uses the extracted value to look up available AccessKey secrets. If the extracted appId is a non-canonical variant that does not exactly match the AccessKey cache key, ConfigService may treat the request as having no available secrets and allow it to continue without signature verification.

This can happen when downstream release lookup still matches the real appId under database collations that treat the values as equivalent. Examples include accent variants under accent-insensitive collations, or trailing-space variants under PAD SPACE collations.

Impact

An unauthenticated remote attacker may read configuration data from affected ConfigService endpoints when AccessKey / management key authentication is enabled for the target app and the deployment database collation treats a non-canonical appId variant as equivalent to the real appId.

Affected endpoints

The primary impact is on ConfigService configuration read endpoints under /configs and /configfiles. Notification endpoints using appId parameters are also hardened as defense-in-depth.

Status

Fixed in Apollo 2.5.2. Users should upgrade to Apollo 2.5.2 or later.

Related advisory

The raw config file endpoint parsing issue originally described in this advisory has been split into GHSA-h4pc-58cc-hc95 so each independently fixable vulnerability can receive its own CVE.

AnalysisAI

Authentication bypass in Apollo (Ctrip apolloconfig) ConfigService allows an unauthenticated remote attacker to read protected configuration data from /configs and /configfiles endpoints even when AccessKey/management-key authentication is enabled. The flaw stems from ConfigService accepting a non-canonical appId variant (e.g. accented or trailing-space forms) that misses the AccessKey secret cache lookup - causing signature verification to be skipped - while the downstream release lookup still resolves the value to the real, protected app under equivalence-treating database collations. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the confidentiality-only impact drives the CVSS 7.5 (High) rating.

Technical ContextAI

Apollo is a distributed configuration-management platform (com.ctrip.framework.apollo, distributed via Maven) whose ConfigService component serves runtime config to client applications and enforces per-app access control through AccessKey signatures. The root cause is CWE-20 (Improper Input Validation): appId is extracted from config/notification requests and used as the exact cache key to fetch that app's AccessKey secrets, but the extracted string is not canonicalized before this security-relevant comparison. When the database collation for the underlying release lookup is accent-insensitive or uses PAD SPACE semantics (common MySQL defaults such as utf8_general_ci for trailing spaces), a variant appId like 'app ' or an accented equivalent fails the strict in-memory cache-key match - so ConfigService concludes no secrets are configured and skips verification - yet the SQL release query treats the variant as equal to the canonical appId and returns the protected app's data. The mismatch between an exact-match security check and a collation-loose data lookup is the essence of the bypass.

RemediationAI

Vendor-released patch: Apollo 2.5.2 - upgrade apollo-configservice, then apollo-adminservice, then apollo-portal in that order (per the v2.5.2 release notes at https://github.com/apolloconfig/apollo/releases/tag/v2.5.2; there is no schema change from 2.5.1 to 2.5.2, so it is a straightforward binary redeploy). The core fix validates ConfigService AccessKey app IDs during client authentication (commit 310809d557e01c6803051736cd525e333ffe00ec). If immediate upgrade is not possible, reduce exposure by restricting network access to the ConfigService /configs and /configfiles endpoints to trusted client subnets via firewall or reverse-proxy allowlisting (trade-off: must enumerate all legitimate Apollo client sources or risk breaking config delivery), and consider aligning the underlying database collation to a case/accent/space-sensitive collation for the appId columns so variant values no longer resolve to the canonical app (trade-off: a collation change can affect existing lookups and requires careful testing). Review the advisory GHSA-4w3q-qpfq-v992 for authoritative guidance; the related raw-config-file parsing issue was split into GHSA-h4pc-58cc-hc95 and should be tracked separately.