Apollo is a configuration management system used in microservice environments. Versions before 2.5.2 of Apollo ConfigService are vulnerable to improper input validation (CWE-20) and authentication bypass issues (CWE-287) because the service accepts non-canonical appId variants during authentication. This allows an attacker to bypass AccessKey or management key authentication by using appId variants such as those differing only by accents or trailing spaces under certain collation rules. As a result, unauthorized access to configuration data on the /configs and /configfiles endpoints is possible. The vulnerability is addressed in Apollo version 2.5.2.

An attacker can gain unauthorized read access to configuration data protected by AccessKey or management key authentication by exploiting the acceptance of non-canonical appId variants. This leads to a confidentiality breach of sensitive configuration information. There is no indication of integrity or availability impact. The CVSS v3.1 base score is 7.5 (High), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact.

Upgrade Apollo ConfigService to version 2.5.2 or later, where this vulnerability is fixed. No other mitigations are indicated or required by the vendor advisory. Patch status is confirmed fixed in 2.5.2.