https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T15:46:03.843308+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-159216 EUVD-2026-159216 2026-10-09T15:46:03.889683+00:00 EUVD-2026-159216 https://cve.radiocsirt.org/vuln/fkie_cve-2024-43397 fkie_cve-2024-43397 2026-10-09T15:46:03.889721+00:00

Apollo is a configuration management system. A vulnerability exists in the synchronization configuration feature that allows users to craft specific requests to bypass permission checks. This exploit enables them to modify a namespace without the necessary permissions. The issue was addressed with an input parameter check which was released in version 2.3.0.

 https://cve.radiocsirt.org/vuln/ghsa-c6c3-h4f7-3962 GHSA-c6c3-h4f7-3962 — apollo-portal has potential unauthorized access issue 2026-10-09T15:46:03.889754+00:00

Affected: Maven: com.ctrip.framework.apollo:apollo

### Impact A vulnerability exists in the synchronization configuration feature that allows users to craft specific requests to bypass permission checks. This exploit enables them to modify a namespace without the necessary permissions.

### Patches The issue was addressed with an input parameter check in #5192, which was released in version [2.3.0](https://github.com/apolloconfig/apollo/releases/tag/v2.3.0).

### Workarounds To mitigate the issue without upgrading, follow the recommended practices to prevent Apollo from being exposed to the internet.

### Credits The vulnerability was reported and reproduced by [Lakeswang](https://github.com/Lakes-bitgetsec).

### References For any questions or comments regarding this advisory: * Open an issue in [issue](https://github.com/apolloconfig/apollo/issues) * Email us at [apollo-config@googlegroups.com](mailto:apollo-config@googlegroups.com)