CVE-2026-59955: falha de alta gravidade em apolloconfig apollo
Apollo ConfigService access key authentication bypass via raw config file appId parsing
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.5epss 0.6%
Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.2, Apollo ConfigService may allow unauthorized access to raw configuration data when AccessKey or management key authentication is enabled because requests under /configfiles/raw/{appId}/{clusterName}/{namespace} are parsed for authentication as appId raw instead of the actual path appId, causing ConfigService to look up AccessKey secrets for raw before verifying the request signature and potentially continue without signature verification for the target appId. This issue is fixed in version 2.5.2.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
apolloconfig · apolloCVEs relacionadas — apolloconfig apollo
No mesmo produto, das mais perigosas para as menos.
CVE-2023-25570HIGHApollo has potential access control security issue in eurekaEPSS 0.8%CVE-2026-59954HIGHApollo ConfigService access key authentication bypass via appId parsing and non-canonical matchingEPSS 0.6%CVE-2025-32781MEDIUMApollo: Apollo Portal release endpoint allows cross-application configuration disclosure via releaseIdEPSS 0.4%CVE-2023-25569MEDIUMapollo-portal has potential CSRF issueEPSS 0.4%CVE-2024-43397MEDIUMPotential unauthorized access issue in apollo-portalEPSS 0.3%