{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"com.ctrip.framework.apollo:apollo","cve_ids":["CVE-2026-59955"],"ecosystem":"Maven","epss":0.00574,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-h4pc-58cc-hc95","id":"tcs_01M5N8ZNAMXB8G5WAMP3FE9CAS","modified_at":"2026-07-20T19:30:24.085663802Z","published_at":"2026-07-13T18:37:14Z","references":["https://osv.dev/vulnerability/GHSA-h4pc-58cc-hc95","https://github.com/apolloconfig/apollo/security/advisories/GHSA-h4pc-58cc-hc95","https://nvd.nist.gov/vuln/detail/CVE-2026-59955","https://github.com/apolloconfig/apollo/commit/310809d557e01c6803051736cd525e333ffe00ec","https://github.com/apolloconfig/apollo","https://github.com/apolloconfig/apollo/releases/tag/v2.5.2"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-h4pc-58cc-hc95","url":"https://osv.dev/vulnerability/GHSA-h4pc-58cc-hc95"}],"summary":"Apollo ConfigService access key authentication bypass via raw config file appId parsing"}