Skip to content

Correct Apollo ConfigService package scope for GHSA-h4pc-58cc-hc95 #9168

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
nobodyiam wants to merge 1 commit into
base: nobodyiam/advisory-improvement-9168
Choose a base branch
from
+7 −3
Open

Correct Apollo ConfigService package scope for GHSA-h4pc-58cc-hc95 #9168

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 7 additions & 3 deletions advisories/github-reviewed/2026/07/GHSA-h4pc-58cc-hc95/GHSA-h4pc-58cc-hc95.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
"CVE-2026-59955"
],
"summary": "Apollo ConfigService access key authentication bypass via raw config file appId parsing",
"details": "### Summary\nApollo ConfigService may allow unauthorized access to raw configuration data when AccessKey / management key authentication is enabled because authentication parsed the appId incorrectly for the raw config file endpoint.\n\n### Details\nRequests under /configfiles/raw/{appId}/{clusterName}/{namespace} were parsed for authentication as appId \"raw\" instead of the actual path appId. ConfigService used the parsed appId to look up available AccessKey secrets before verifying the request signature.\n\nIf no AccessKey is configured for an application literally named \"raw\", ConfigService may treat the request as having no available secrets and allow it to continue without signature verification, even when AccessKey / management key authentication is enabled for the actual target appId in the path.\n\n### Impact\nAn unauthenticated remote attacker may read raw configuration data from affected ConfigService endpoints when AccessKey / management key authentication is enabled for the target app and the attacker requests the raw config file endpoint.\n\n### Affected endpoints\nThe primary impact is on ConfigService raw config file reads under /configfiles/raw/{appId}/{clusterName}/{namespace}.\n\n### Status\nFixed in Apollo 2.5.2. Users should upgrade to Apollo 2.5.2 or later.\n\n### Related advisory\nThe non-canonical appId matching issue is tracked separately in GHSA-4w3q-qpfq-v992 so each independently fixable vulnerability can receive its own CVE.",
"details": "### Summary\nApollo ConfigService may allow unauthorized access to raw configuration data when AccessKey / management key authentication is enabled because authentication parsed the appId incorrectly for the raw config file endpoint.\n\n### Details\nRequests under /configfiles/raw/{appId}/{clusterName}/{namespace} were parsed for authentication as appId \"raw\" instead of the actual path appId. ConfigService used the parsed appId to look up available AccessKey secrets before verifying the request signature.\n\nIf no AccessKey is configured for an application literally named \"raw\", ConfigService may treat the request as having no available secrets and allow it to continue without signature verification, even when AccessKey / management key authentication is enabled for the actual target appId in the path.\n\n### Impact\nAn unauthenticated remote attacker may read raw configuration data from affected ConfigService endpoints when AccessKey / management key authentication is enabled for the target app and the attacker requests the raw config file endpoint.\n\n### Component scope\n\nThis advisory affects Apollo ConfigService server deployments only. It does not affect Maven client libraries such as `com.ctrip.framework.apollo:apollo-core`, `com.ctrip.framework.apollo:apollo-client`, or `com.ctrip.framework.apollo:apollo-openapi` when they are used only as client-side dependencies. The Maven parent POM `com.ctrip.framework.apollo:apollo` and the client libraries are not the vulnerable runtime component.\n\n### Affected endpoints\nThe primary impact is on ConfigService raw config file reads under /configfiles/raw/{appId}/{clusterName}/{namespace}.\n\n### Status\nFixed in Apollo 2.5.2. Users should upgrade to Apollo 2.5.2 or later.\n\n### Related advisory\nThe non-canonical appId matching issue is tracked separately in GHSA-4w3q-qpfq-v992 so each independently fixable vulnerability can receive its own CVE.",
"severity": [
{
"type": "CVSS_V3",
Expand All @@ -18,7 +18,7 @@
{
"package": {
"ecosystem": "Maven",
"name": "com.ctrip.framework.apollo:apollo"
"name": "com.ctrip.framework.apollo:apollo-configservice"
},
"ranges": [
{
Expand Down Expand Up @@ -55,6 +55,10 @@
{
"type": "WEB",
"url": "https://github.com/apolloconfig/apollo/releases/tag/v2.5.2"
},
{
"type": "WEB",
"url": "https://github.com/apolloconfig/apollo/issues/5661"
}
],
"database_specific": {
Expand All @@ -67,4 +71,4 @@
"github_reviewed_at": "2026-07-13T18:37:14Z",
"nvd_published_at": "2026-07-15T17:16:51Z"
}
}
}