What is the CVSS score of CVE-2026-59955?

CVE-2026-59955 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.5%.

Which versions of Canonical are affected by CVE-2026-59955?

Apollo ConfigService (versions prior to 2.5.2) contains an authentication bypass vulnerability that allows unauthenticated attackers to retrieve sensitive application configuration data including…. A patch is available.

How to fix or mitigate CVE-2026-59955?

Within 24 hours: audit ConfigService access logs for the /configfiles/raw endpoint to identify potential unauthorized access and compromised credentials; restrict network access to Apollo ConfigService to known application servers only. Within 7 days: evaluate compatibility and deployment strategy for Apollo ConfigService 2.5.2; schedule maintenance window and prepare rollback plan. Within 30 days: deploy Apollo ConfigService 2.5.2 across all production and non-production instances; verify the upgrade blocks raw endpoint access without credentials; audit and rotate any secrets that may have been exposed.

Canonical CVE-2026-59955

EUVD-2026-44724 HIGH

Improper Input Validation (CWE-20)

2026-07-13 https://github.com/apolloconfig/apollo

GHSA-h4pc-58cc-hc95

Authentication Bypass Canonical

7.5

CVSS 3.1 · Vendor: https://github.com/apolloconfig/apollo

Severity by source

Vendor (https://github.com/apolloconfig/apollo) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (https://github.com/apolloconfig/apollo) · only source for this CVE.

CVSS VectorVendor: https://github.com/apolloconfig/apollo

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 15, 2026 - 21:18 EUVD

Source Code Evidence Fetched

Jul 13, 2026 - 19:25 vuln.today

Analysis Generated

Jul 13, 2026 - 19:25 vuln.today

CVE Published

Jul 13, 2026 - 18:37 github-advisory

HIGH 7.5

DescriptionCVE.org

Summary

Apollo ConfigService may allow unauthorized access to raw configuration data when AccessKey / management key authentication is enabled because authentication parsed the appId incorrectly for the raw config file endpoint.

Details

Requests under /configfiles/raw/{appId}/{clusterName}/{namespace} were parsed for authentication as appId "raw" instead of the actual path appId. ConfigService used the parsed appId to look up available AccessKey secrets before verifying the request signature.

If no AccessKey is configured for an application literally named "raw", ConfigService may treat the request as having no available secrets and allow it to continue without signature verification, even when AccessKey / management key authentication is enabled for the actual target appId in the path.

Impact

An unauthenticated remote attacker may read raw configuration data from affected ConfigService endpoints when AccessKey / management key authentication is enabled for the target app and the attacker requests the raw config file endpoint.

Affected endpoints

The primary impact is on ConfigService raw config file reads under /configfiles/raw/{appId}/{clusterName}/{namespace}.

Status

Fixed in Apollo 2.5.2. Users should upgrade to Apollo 2.5.2 or later.

Related advisory

The non-canonical appId matching issue is tracked separately in GHSA-4w3q-qpfq-v992 so each independently fixable vulnerability can receive its own CVE.

AnalysisAI

Access key authentication bypass in Apollo ConfigService (com.ctrip.framework.apollo, versions < 2.5.2) lets an unauthenticated remote attacker read raw configuration data even when AccessKey/management-key authentication is enabled. The service mis-parses the appId on the /configfiles/raw/{appId}/{clusterName}/{namespace} endpoint as the literal string 'raw', so no matching secret is found and the signature check is skipped for the real target app. No public exploit identified at time of analysis; the flaw is fixed in Apollo 2.5.2.