CVE-2026-59954: Apollo ConfigService Auth Bypass Flaw

CVE-2026-59954 Overview

Apollo is a configuration management system used in microservice architectures to centralize application settings. CVE-2026-59954 is an authentication bypass in Apollo ConfigService affecting versions prior to 2.5.2. When AccessKey or management key authentication is enabled, ConfigService accepts a non-canonical appId variant during authentication while downstream request handling resolves it to the protected app. Attackers can exploit accent-insensitive collations or trailing-space variants under PAD SPACE collations against the /configs and /configfiles endpoints. The result is unauthorized access to configuration data that should be gated by AccessKey checks. The issue is fixed in Apollo 2.5.2 and is tracked under [CWE-20] Improper Input Validation.

Critical Impact
Remote unauthenticated attackers can bypass AccessKey authentication and read protected configuration data served by Apollo ConfigService.

Affected Products

Apollo Config (apolloconfig/apollo) versions prior to 2.5.2
Apollo ConfigService component (/configs and /configfiles endpoints)
Deployments using AccessKey or management key authentication

Discovery Timeline

2026-07-15 - CVE-2026-59954 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-59954

Vulnerability Analysis

The vulnerability arises from inconsistent handling of the appId parameter between the authentication filter and the request handler. Apollo ConfigService applies AccessKey validation using the raw appId provided in the request. Downstream persistence layers then normalize that identifier through database collation rules before resolving the target application. This split creates a canonicalization mismatch where two distinct string values map to the same protected app record. Attackers can supply an appId variant that fails to match any AccessKey configuration yet still resolves to the legitimate app during data retrieval.

Root Cause

The underlying defect is an input validation gap in AccessKeyUtil and the filter registration in ConfigServiceAutoConfiguration. Apollo did not enforce canonical appId formatting before evaluating AccessKey requirements. Under MySQL accent-insensitive collations such as utf8mb4_general_ci, characters like á compare equal to a, and under PAD SPACE collations trailing spaces are ignored during equality checks. Authentication logic did not account for these equivalence classes, allowing bypass through crafted variants.

Attack Vector

Exploitation requires only network reachability to the Apollo ConfigService HTTP endpoints. An attacker sends a request to /configs/{appId}/{cluster}/{namespace} or /configfiles/{appId}/{cluster}/{namespace} using a modified appId such as an accented character or a trailing-space variant of the legitimate identifier. The AccessKey filter fails to locate an active key for the mutated string and permits the request. The service subsequently returns the configuration data belonging to the canonical app.

java

// Patch: apollo-configservice/src/main/java/com/ctrip/framework/apollo/configservice/ConfigServiceAutoConfiguration.java
    filterRegistrationBean.setFilter(new ClientAuthenticationFilter(bizConfig, accessKeyUtil));
    filterRegistrationBean.addUrlPatterns("/configs/*");
    filterRegistrationBean.addUrlPatterns("/configfiles/*");
+   filterRegistrationBean.addUrlPatterns("/notifications/v2");
    filterRegistrationBean.addUrlPatterns("/notifications/v2/*");

    return filterRegistrationBean;

// Patch: apollo-configservice/src/main/java/com/ctrip/framework/apollo/configservice/util/AccessKeyUtil.java
 package com.ctrip.framework.apollo.configservice.util;

+import com.ctrip.framework.apollo.common.utils.InputValidator;
 import com.ctrip.framework.apollo.configservice.service.AccessKeyServiceWithCache;
 import com.ctrip.framework.apollo.core.signature.Signature;
 import com.google.common.base.Strings;

Source: Apollo Security Patch Commit 310809d

Detection Methods for CVE-2026-59954

Indicators of Compromise

Requests to /configs/* or /configfiles/* where the appId path segment contains non-ASCII accented characters or trailing whitespace
Successful responses returning configuration payloads for appId values that do not appear in the AccessKey configuration table
HTTP access logs showing repeated probing of the same namespace with slight appId variations

Detection Strategies

Compare appId values in ConfigService HTTP access logs against the canonical appId list from the AdminService database and flag mismatches
Alert on any request where the raw appId differs from its Unicode NFC-normalized and trim-normalized form
Correlate ClientAuthenticationFilter allow decisions with subsequent 200 responses for apps that have AccessKey enabled

Monitoring Recommendations

Enable verbose logging on ClientAuthenticationFilter and AccessKeyUtil to capture the raw appId received per request
Ingest Apollo ConfigService logs into a centralized SIEM and build dashboards for /configs and /configfiles traffic broken down by appId character set
Monitor database collation settings on the Apollo config schema to confirm they match the version-specific hardening in 2.5.2

How to Mitigate CVE-2026-59954

Immediate Actions Required

Upgrade all Apollo ConfigService instances to version 2.5.2 or later
Audit AccessKey configuration to confirm every protected app has an active key enforced
Review recent ConfigService access logs for unusual appId variants that could indicate prior exploitation

Patch Information

The fix is released in Apollo 2.5.2. The patch adds InputValidator usage in AccessKeyUtil to enforce canonical appId formatting and extends the ClientAuthenticationFilter URL patterns to include /notifications/v2. Details are available in the Apollo Release 2.5.2 notes and the GHSA-4w3q-qpfq-v992 advisory.

Workarounds

Place Apollo ConfigService behind a reverse proxy that rejects requests containing non-ASCII characters or trailing whitespace in the appId path segment
Change database collations on the Apollo config schema to case- and accent-sensitive variants such as utf8mb4_bin to remove the equivalence classes exploited by this bug
Restrict network access to ConfigService endpoints to trusted client subnets until the upgrade is completed

bash

# Example NGINX rule to block non-ASCII appIds ahead of Apollo ConfigService
location ~ ^/(configs|configfiles)/([^/]+)/ {
    if ($2 ~* "[^A-Za-z0-9_.-]") { return 400; }
    if ($2 ~ " $")               { return 400; }
    proxy_pass http://apollo-configservice;
}