BaseFortify

Publication date: 2025-11-07

Last updated on: 2025-11-12

Assigner: GitHub, Inc.

Description

Apollo Router Core is a configurable Rust graph router written to run a federated supergraph using Apollo Federation 2. Versions 1.61.12-rc.0 and below and 2.8.1-rc.0 allow unauthorized access to protected data through schema elements with access control directives (@authenticated, @requiresScopes, and @policy) that were renamed via @link imports. Router did not enforce renamed access control directives on schema elements (e.g. fields and types), allowing queries to bypass those element-level access controls. This issue is fixed in versions 1.61.12 and 2.8.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-07

Last Modified

2025-11-12

Generated

2026-07-06

AI Q&A

2025-11-07

EPSS Evaluated

2026-07-05

NVD

CVE-2025-64347

Affected Vendors & Products

Vendor	Product	Version / Range
apollographql	router	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability in Apollo Router Core allows unauthorized access to protected data. It occurs because the router does not enforce access control directives (@authenticated, @requiresScopes, and @policy) on schema elements that have been renamed via @link imports. As a result, queries can bypass element-level access controls, exposing data that should be protected.

Impact Analysis

This vulnerability can lead to unauthorized access to sensitive or protected data within the Apollo Router Core system. Attackers could exploit this to retrieve data they should not have access to, potentially leading to data breaches and exposure of confidential information.

Mitigation Strategies

Upgrade Apollo Router Core to version 1.61.12 or 2.8.1 or later, as these versions include the fix that enforces access control directives properly and prevents unauthorized access through renamed schema elements.

Hi! I’m here to help you understand CVE-2025-64347. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70