CVE-2026-59955
Last modified
CVE-2026-59955 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.2, Apollo ConfigService may allow unauthorized access to raw configuration data when AccessKey or management key authentication is enabled because requests under /configfiles/raw/{appId}/{clusterName}/{namespace} are parsed for authentication as appId raw instead of the actual path appId, causing ConfigService to look up AccessKey secrets for raw before verifying the request signature and potentially continue without signature verification for the target appId. EPSS estimates a 0.57% chance of exploitation in the next 30 days.
Description
Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.2, Apollo ConfigService may allow unauthorized access to raw configuration data when AccessKey or management key authentication is enabled because requests under /configfiles/raw/{appId}/{clusterName}/{namespace} are parsed for authentication as appId raw instead of the actual path appId, causing ConfigService to look up AccessKey secrets for raw before verifying the request signature and potentially continue without signature verification for the target appId. This issue is fixed in version 2.5.2.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| apolloconfig | apollo | < 2.5.2 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-59955?
How severe is CVE-2026-59955?
How do I fix CVE-2026-59955?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-59949yawkat LZ4 Java provides LZ4 compression for Java. Prior to …6.5
- CVE-2026-5995A weakness has been identified in Totolink A7100RU 7.4cu.231…9.8
- CVE-2026-59950The MCP Python SDK, called mcp on PyPI, is a Python implemen…8.1
- CVE-2026-59951The MCP Python SDK, called mcp on PyPI, is a Python implemen…6.9
- CVE-2026-59952Valibot helps validate data using a schema. Versions prior t…6.9
- CVE-2026-59954Apollo is a reliable configuration management system suitabl…7.5
- CVE-2026-59956OpenImageIO is a toolset for reading, writing, and manipulat…6.1
- CVE-2026-59959SAIL is a cross-platform library for loading and saving imag…4.8
- CVE-2026-5996A security vulnerability has been detected in Totolink A7100…9.8
- CVE-2026-59960Argos JavaScript provides official Argos SDKs for JavaScript…7.5
- CVE-2026-59962Tandoor Recipes is an application for managing recipes, plan…6.5
- CVE-2026-59963Tandoor Recipes is an application for managing recipes, plan…7.1
Are you affected by CVE-2026-59955?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST