{"items":[{"id":"NVI-00016119","kind":"vulnerability","title":"Apollo ConfigService access key authentication bypass via raw config file appId parsing","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-h4pc-58cc-hc95","CVE-2026-59955"],"plain_summary":"GitHub lists this reviewed advisory for com.ctrip.framework.apollo:apollo. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-5d46edfd0f88f526e40c0633cada8d33"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-07-20T19:16:36.000Z","value":"7.5 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-27aaf52f8eb87376710834979f50155a"},{"kind":"CVSS","as_of":"2026-10-24T21:10:00.130Z","value":"7.5 HIGH (3.1)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-5d46edfd0f88f526e40c0633cada8d33"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-27aaf52f8eb87376710834979f50155a","url":"https://github.com/advisories/GHSA-h4pc-58cc-hc95","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-h4pc-58cc-hc95","publisher":"GitHub Advisory Database","observed_at":"2026-11-04T02:49:06.528Z"},{"id":"sr-5d46edfd0f88f526e40c0633cada8d33","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59955","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-59955","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-08T08:05:01.676Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-27aaf52f8eb87376710834979f50155a"],"technology":"com.ctrip.framework.apollo:apollo","known_exclusions":[],"conditions_summary":"### Summary\nApollo ConfigService may allow unauthorized access to raw configuration data when AccessKey / management key authentication is enabled because authentication parsed the appId incorrectly for the raw config file endpoint.\n\n### Details\nRequests under /configfiles/raw/{appId}/{clusterName}/{namespace} were parsed for authentication as appId \"raw\" instead of the actual path appId. ConfigService used the parsed appId to look up available AccessKey secrets before verifying the request signature.\n\nIf no AccessKey is configured for an application literally named \"raw\", ConfigService may treat the request as having no available secrets and allow it to continue without signature verification, even when AccessKey / management key authentication is enabled for the actual target appId in the path.\n\n### Impact\nAn unauthenticated remote attacker may read raw configuration data from affected ConfigService endpoints when AccessKey / management key authentication is enabled for the target app and the attacker requests the raw config file endpoint.\n\n### Affected endpoints\nThe primary impact is on ConfigService raw config file reads under /configfiles/raw/{appId}/{clusterName}/{namespace}.","public_affected_ranges":["< 2.5.2"]}],"null_published_at":"2026-11-08T19:53:44.060Z","source_updated_at":"2026-07-20T19:16:36.000Z","source_disclosed_at":"2026-07-13T18:37:14.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-11-04T02:49:06.528Z"},{"id":"NVI-00016119","kind":"vulnerability","title":"Apollo ConfigService access key authentication bypass via raw config file appId parsing","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-h4pc-58cc-hc95","CVE-2026-59955"],"plain_summary":"GitHub lists this reviewed advisory for com.ctrip.framework.apollo:apollo. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-27aaf52f8eb87376710834979f50155a"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-07-20T19:16:36.000Z","value":"7.5 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-27aaf52f8eb87376710834979f50155a"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-27aaf52f8eb87376710834979f50155a","url":"https://github.com/advisories/GHSA-h4pc-58cc-hc95","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-h4pc-58cc-hc95","publisher":"GitHub Advisory Database","observed_at":"2026-11-04T02:49:06.528Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-27aaf52f8eb87376710834979f50155a"],"technology":"com.ctrip.framework.apollo:apollo","known_exclusions":[],"conditions_summary":"### Summary\nApollo ConfigService may allow unauthorized access to raw configuration data when AccessKey / management key authentication is enabled because authentication parsed the appId incorrectly for the raw config file endpoint.\n\n### Details\nRequests under /configfiles/raw/{appId}/{clusterName}/{namespace} were parsed for authentication as appId \"raw\" instead of the actual path appId. ConfigService used the parsed appId to look up available AccessKey secrets before verifying the request signature.\n\nIf no AccessKey is configured for an application literally named \"raw\", ConfigService may treat the request as having no available secrets and allow it to continue without signature verification, even when AccessKey / management key authentication is enabled for the actual target appId in the path.\n\n### Impact\nAn unauthenticated remote attacker may read raw configuration data from affected ConfigService endpoints when AccessKey / management key authentication is enabled for the target app and the attacker requests the raw config file endpoint.\n\n### Affected endpoints\nThe primary impact is on ConfigService raw config file reads under /configfiles/raw/{appId}/{clusterName}/{namespace}.","public_affected_ranges":["< 2.5.2"]}],"null_published_at":"2026-11-04T10:04:27.895Z","source_updated_at":"2026-07-20T19:16:36.000Z","source_disclosed_at":"2026-07-13T18:37:14.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-04T02:49:06.528Z"}],"next_cursor":null,"snapshot_revision":"42594"}