CVE-2026-59954: falha de alta gravidade em apolloconfig apollo
Apollo ConfigService access key authentication bypass via appId parsing and non-canonical matching
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.5epss 0.6%
Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.2, Apollo ConfigService may allow unauthorized access to configuration data when AccessKey or management key authentication is enabled because ConfigService can accept a non-canonical appId variant during authentication while downstream request handling resolves it to the protected app, including accent variants under accent-insensitive collations or trailing-space variants under PAD SPACE collations on /configs and /configfiles endpoints. This issue is fixed in version 2.5.2.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
apolloconfig · apolloCVEs relacionadas — apolloconfig apollo
No mesmo produto, das mais perigosas para as menos.
CVE-2023-25570HIGHApollo has potential access control security issue in eurekaEPSS 0.8%CVE-2026-59955HIGHApollo ConfigService access key authentication bypass via raw config file appId parsingEPSS 0.6%CVE-2025-32781MEDIUMApollo: Apollo Portal release endpoint allows cross-application configuration disclosure via releaseIdEPSS 0.4%CVE-2023-25569MEDIUMapollo-portal has potential CSRF issueEPSS 0.4%CVE-2024-43397MEDIUMPotential unauthorized access issue in apollo-portalEPSS 0.3%