CVE-2026-59955 Apollo ConfigService access key authentication bypass via raw config file appId parsing
Attackers can bypass authentication to read raw configuration data in Apollo ConfigService when AccessKey authentication is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-59955?
CVE-2026-59955 is a high-severity authentication bypass vulnerability in apolloconfig apollo, published on 15 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.2, Apollo ConfigService may allow unauthorized access to raw configuration data when AccessKey or management key authentication is enabled because requests under /configfiles/raw/{appId}/{clusterName}/{namespace} are parsed for authentication as appId raw instead of the actual path appId, causing ConfigService to look up AccessKey secrets for raw before verifying the request signature and potentially continue without signature verification for the target appId. This issue is fixed in version 2.5.2.
Which versions are affected by CVE-2026-59955?
2 open source packages ship an affected version, including com.ctrip.framework.apollo:apollo.
| Package | Affected | Fixed in |
|---|---|---|
com.ctrip.framework.apollo:apollo Maven | All versions | None |
com.ctrip.framework.apollo:apollo Maven | All versions | None |
How do I fix CVE-2026-59955?
No fix has been published for CVE-2026-59955 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-59955 being exploited?
There is no known exploitation of CVE-2026-59955 in the wild and no public exploit code.
Sources
Also known as GHSA-h4pc-58cc-hc95.