CVE-2026-59954: Apollo ConfigService access key authentication bypass via appId parsing and non-canonical matching

July 13, 2026 (updated July 20, 2026)

Apollo ConfigService may allow unauthorized access to configuration data when AccessKey / management key authentication is enabled and ConfigService accepts a non-canonical appId variant during authentication while downstream request handling resolves it to the protected app.

References

github.com/advisories/GHSA-4w3q-qpfq-v992
github.com/apolloconfig/apollo/commit/310809d557e01c6803051736cd525e333ffe00ec
github.com/apolloconfig/apollo/releases/tag/v2.5.2
github.com/apolloconfig/apollo/security/advisories/GHSA-4w3q-qpfq-v992
nvd.nist.gov/vuln/detail/CVE-2026-59954

Code Behaviors & Features

Detect and mitigate CVE-2026-59954 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →