Description
Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.2, Apollo ConfigService may allow unauthorized access to raw configuration data when AccessKey or management key authentication is enabled because requests under /configfiles/raw/{appId}/{clusterName}/{namespace} are parsed for authentication as appId raw instead of the actual path appId, causing ConfigService to look up AccessKey secrets for raw before verifying the request signature and potentially continue without signature verification for the target appId. This issue is fixed in version 2.5.2.
Published: 2026-07-15
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw in Apollo ConfigService causes the appId segment of the /config path to be parsed incorrectly when AccessKey authentication is turned on. As a result, the service attempts to authenticate the request against the appId string instead of verifying the request signature, allowing an attacker to retrieve raw configuration files without valid credentials. This represents an Improper Input Validation (CWE‑20) and an Improper Authentication (CWE‑287).

Affected Systems

Apollo ConfigService, distributed by apolloconfig:apollo. All releases before version 2.5.2 are affected; the vulnerability is fixed in v2.5.2 and later.

Risk and Exploitability

The CVSS score of 7.5 indicates high severity, but the EPSS score of <1% suggests that exploitation is currently unlikely. The flaw is not listed in CISA’s KEV catalog. An attacker can exploit the vulnerability simply by sending HTTP requests to /configfiles/raw/... from any host that can reach the ConfigService. Because the bypass occurs only when AccessKey authentication is enabled, the attack is straightforward and possible from remote locations when the endpoint is exposed.

Generated by OpenCVE AI on July 31, 2026 at 03:19 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Apollo ConfigService to version 2.5.2 or later to apply the official fix.
  • If an upgrade is not immediately possible, disable AccessKey or management key authentication for the ConfigService to eliminate the bypass.
  • Restrict external traffic to the /configfiles/raw endpoint using firewall rules or network segmentation so that only trusted systems can access it.
  • If raw configuration retrieval is not needed in your environment, consider disabling the raw config endpoint entirely.

Generated by OpenCVE AI on July 31, 2026 at 03:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-h4pc-58cc-hc95 Apollo ConfigService access key authentication bypass via raw config file appId parsing
History

Thu, 16 Jul 2026 01:15:00 +0000

Type Values Removed Values Added
First Time appeared Apolloconfig
Apolloconfig apollo
Vendors & Products Apolloconfig
Apolloconfig apollo

Wed, 15 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 15 Jul 2026 17:00:00 +0000

Type Values Removed Values Added
Description Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.2, Apollo ConfigService may allow unauthorized access to raw configuration data when AccessKey or management key authentication is enabled because requests under /configfiles/raw/{appId}/{clusterName}/{namespace} are parsed for authentication as appId raw instead of the actual path appId, causing ConfigService to look up AccessKey secrets for raw before verifying the request signature and potentially continue without signature verification for the target appId. This issue is fixed in version 2.5.2.
Title Apollo ConfigService access key authentication bypass via raw config file appId parsing
Weaknesses CWE-20
CWE-287
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Apolloconfig Apollo
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-15T18:11:39.238Z

Reserved: 2026-07-07T18:49:15.607Z

Link: CVE-2026-59955

cve-icon Vulnrichment

Updated: 2026-07-15T18:11:36.601Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T03:30:18Z

Weaknesses
  • CWE-20

    Improper Input Validation

  • CWE-287

    Improper Authentication