PT-2026-60109 · Apollo · Apollo

Published 2026-07-13 · Updated 2026-07-15 · CVE-2026-59954

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apollo versions prior to 2.5.2

Description Apollo ConfigService may allow unauthorized access to configuration data when AccessKey or management key authentication is enabled. The issue occurs because ConfigService can accept a non-canonical appId variant during authentication, which may cause the system to treat the request as having no available secrets and bypass signature verification. However, downstream request handling may still resolve this variant to the protected app due to database collations that treat different values as equivalent, such as accent variants under accent-insensitive collations or trailing-space variants under PAD SPACE collations. This allows an unauthenticated remote attacker to read configuration data via the /configs and /configfiles endpoints.

Recommendations Update to version 2.5.2.

Fix

Improper Authentication

RCE

Weakness Enumeration

CWE-287

CWE-20

Related Identifiers

CVE-2026-59954

GHSA-4W3Q-QPFQ-V992

Affected Products

Apollo

References · 6

• https://osv.dev/vulnerability/GHSA-4w3q-qpfq-v992 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-59954 · Security Note
• https://github.com/apolloconfig/apollo/security/advisories/GHSA-4w3q-qpfq-v992 · Note
• https://github.com/apolloconfig/apollo · Note
• https://github.com/apolloconfig/apollo/releases/tag/v2.5.2 · Note
• https://github.com/apolloconfig/apollo/commit/310809d557e01c6803051736cd525e333ffe00ec · Note