CVE-2026-59954: Apollo ConfigService access key authentication bypass via appId parsing and non-canonical matching

July 13, 2026 (updated July 20, 2026)

Apollo ConfigService may allow unauthorized access to configuration data when AccessKey / management key authentication is enabled and ConfigService accepts a non-canonical appId variant during authentication while downstream request handling resolves it to the protected app.

References

github.com/advisories/GHSA-4w3q-qpfq-v992
github.com/apolloconfig/apollo/commit/310809d557e01c6803051736cd525e333ffe00ec
github.com/apolloconfig/apollo/releases/tag/v2.5.2
github.com/apolloconfig/apollo/security/advisories/GHSA-4w3q-qpfq-v992
nvd.nist.gov/vuln/detail/CVE-2026-59954

Code Behaviors & Features

Detect and mitigate CVE-2026-59954 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →