Apollo ConfigService can accept a non‑canonical appId variant during authentication, allowing an attacker to bypass AccessKey or management key protection and retrieve configuration data for a protected application. The flaw stems from improper input validation (CWE‑20) and authentication bypass (CWE‑287), enabling attackers to exfiltrate or tamper with configuration settings without permission.

The vulnerability affects Apollo ConfigService deployments before version 2.5.2, released by ap key authentication enabled is at risk until the application is upgraded to v2.5.2 or later.

The CVSS score of 7.5 reflect serious impact, yet the EPSS score is below 1% and the flaw is not listed in the CISA KEV catalog, indicating low current exploitation likelihood. Based on the description, the most likely attack vector is a remote request to the /configs or /configfiles endpoints, where an attacker supplies a variant of the target appId—such as an accent‑insensitive clash or a trailing‑space difference—to trigger the bypass. The issue can be exploited by any authenticated or even unauthenticated non‑ handling.