CVE-2026-59955: Apollo ConfigService access key authentication bypass via raw config file appId parsing

July 13, 2026 (updated July 20, 2026)

Apollo ConfigService may allow unauthorized access to raw configuration data when AccessKey / management key authentication is enabled because authentication parsed the appId incorrectly for the raw config file endpoint.

References

github.com/advisories/GHSA-h4pc-58cc-hc95
github.com/apolloconfig/apollo/commit/310809d557e01c6803051736cd525e333ffe00ec
github.com/apolloconfig/apollo/releases/tag/v2.5.2
github.com/apolloconfig/apollo/security/advisories/GHSA-h4pc-58cc-hc95
nvd.nist.gov/vuln/detail/CVE-2026-59955

Code Behaviors & Features

Detect and mitigate CVE-2026-59955 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →