CVE-2026-59954: Improper Input Validation

Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.2, Apollo ConfigService may allow unauthorized access to configuration data when AccessKey or management key authentication is enabled because ConfigService can accept a...

CVE-2026-59955: Improper Input Validation

Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.2, Apollo ConfigService may allow unauthorized access to raw configuration data when AccessKey or management key authentication is enabled because requests under...

Apollo ConfigService access key authentication bypass via raw config file appId parsing

Summary Apollo ConfigService may allow unauthorized access to raw configuration data when AccessKey / management key authentication is enabled because authentication parsed the appId incorrectly for the raw config file endpoint. Details Requests under /configfiles/raw/appId/clusterName/namespace...

GHSA-H4PC-58CC-HC95 Apollo ConfigService access key authentication bypass via raw config file appId parsing

Summary Apollo ConfigService may allow unauthorized access to raw configuration data when AccessKey / management key authentication is enabled because authentication parsed the appId incorrectly for the raw config file endpoint. Details Requests under /configfiles/raw/appId/clusterName/namespace...

GHSA-4W3Q-QPFQ-V992 Apollo ConfigService access key authentication bypass via appId parsing and non-canonical matching

Summary Apollo ConfigService may allow unauthorized access to configuration data when AccessKey / management key authentication is enabled and ConfigService accepts a non-canonical appId variant during authentication while downstream request handling resolves it to the protected app. Details...

Apollo ConfigService access key authentication bypass via appId parsing and non-canonical matching

Summary Apollo ConfigService may allow unauthorized access to configuration data when AccessKey / management key authentication is enabled and ConfigService accepts a non-canonical appId variant during authentication while downstream request handling resolves it to the protected app. Details...

Apollo Portal: There is a risk of unauthorized access to the Apollo configuration center

Summary Apollo Portal versions before 2.5.0 do not verify application and namespace permissions when an authenticated user requests a release by ID through GET /envs/env/releases/releaseId. When configView.memberOnly.envs is enabled for the requested environment, a low-privileged Portal user can...

GHSA-JXPJ-9J24-W337 Apollo Portal: There is a risk of unauthorized access to the Apollo configuration center

Summary Apollo Portal versions before 2.5.0 do not verify application and namespace permissions when an authenticated user requests a release by ID through GET /envs/env/releases/releaseId. When configView.memberOnly.envs is enabled for the requested environment, a low-privileged Portal user can...

apollo-sdk (>=0.2.4, <=0.2.11), decore-base (>=0.0.13, <=0.0.24) +1 more potentially affected by CVE-2025-59042 via pyinstaller (5.11.0)

pyinstaller PYPI version 5.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on pyinstaller and may be impacted: - apollo-sdk =0.2.4, =0.0.13, =0.2.11, =0.2.12 Source cves: CVE-2025-59042 Source advisory: OSV:PYSEC-2026-1813...

apollo-sdk (>=0.1.1, <=0.1.6), bell-nozzle-master (1.0.8) +5 more potentially affected by CVE-2026-48588 via django (4.1.2)

django PYPI version 4.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - apollo-sdk =0.1.1, =3.11.6, =0.61.0, =0.62.0 Source cves: CVE-2026-48588 Source advisory: OSV:GHSA-3H9F-R86X-QVJX...

airflow-provider-sqream-blue (>=0.0.8, <=0.0.13), apollo-sdk (>=0.1.1, <=0.2.11) +29 more potentially affected by CVE-2023-32732 via grpcio (1.53.0)

grpcio PYPI version 1.53.0 is affected by a known vulnerability. The following packages have a transitive dependency on grpcio and may be impacted: - airflow-provider-sqream-blue =0.0.8, =0.1.1, =0.2.40, =0.1.1, =3.2.0, =3.2.0, =0.4.24, =0.6.24, =1.3.6rc1, =0.3.0, =1.0.5, =0.0.1, =1.6.3, =4.0.0,...

CVE-2026-50185 vulnerabilities

Vulnerabilities for packages: mountpoint-s3, apollo-router, pixi, deno, komodo, yazi...

GHSA-3RJW-M598-PQ24 vulnerabilities

Vulnerabilities for packages: mountpoint-s3, apollo-router, pixi, deno, komodo, yazi...

com.apollographql.execution:apollo-execution-http4k (>=0.0.2, <=0.1.1), com.apollographql.execution:apollo-execution-http4k-jvm (>=0.0.2, <=0.1.1) +333 more potentially affected by CVE-2026-100724 via org.http4k:http4k-core (>=5.0.0.0, <=5.41.0.0)

org.http4k:http4k-core MAVEN version =5.0.0.0, =0.0.2, =0.0.2, =0.0.1, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =0.5.0, =1.30.0, =0.1, =0.1.1 and more Source cves: CVE-2026-100724 Source advisory: OSV:GHSA-JRPC-7VXP-69P6...

CVE-2026-50034 Apollo Pharmacy Blood Glucose Monitoring System APG-01 BT Cleartext Transmission of Sensitive Information

An attacker within BLE communication range can passively intercept wireless traffic and obtain sensitive health-related information, including glucose measurement values...

CVE-2026-52866 Apollo Pharmacy Blood Glucose Monitoring System APG-01 BT Missing Authorization

An attacker within BLE communication range can monopolize the device's only available BLE connection slot, preventing legitimate users or applications from establishing a connection...

Apollo Pharmacy Blood Glucose Monitoring System APG-01 BT

ADVISORY SUMMARY Successful exploitation of these vulnerabilities could allow an attacker to obtain sensitive health-related information and prevent legitimate users from establishing a connection with the device. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize...

ROOT-APP-NPM-GHSA-9Q82-XGWF-VJ6H GHSA-9q82-xgwf-vj6h in @rootio/apollo__server - Patched by Root

Root has patched GHSA-9q82-xgwf-vj6h in the @rootio/apolloserver package for Root:npm. Multiple fixed versions available...

Malicious Package

Overview apollo-vertex is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malware in apollo-vertex

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...