CVE-2025-64530
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-11-13

Last updated on: 2025-11-13

Assigner: GitHub, Inc.

Description
Apollo Federation is an architecture for declaratively composing APIs into a unified graph. A vulnerability in versions of Apollo Federation's composition logic prior to 2.9.5, 2.10.4, 2.11.5, and 2.12.1 allowed some queries to Apollo Router to improperly bypass access controls on types/fields. Apollo Federation incorrectly allowed user-defined access control directives on interface types/fields, which could be bypassed by instead querying the implementing object types/fields in Apollo Router via inline fragments, for example. A fix to versions 2.9.5, 2.10.4, 2.11.5, and 2.12.1 of composition logic in Federation now disallows interfaces types and fields to contain user-defined access control directives. Some workarounds are available. Users of Apollo Rover with an unpatched composition version or are using the Apollo Studio build pipeline with Federation version 2.8 or below should manually copy the access control requirements on interface types/fields to each implementing object type/field where appropriate. Do not remove those access control requirements from the interface types/fields, as unpatched Apollo Composition will not automatically generate them in the supergraph schema. Customers not using Apollo Router access control features (`@authenticated`, `@requiresScopes`, or `@policy` directives) or not specifying access control requirements on interface types/fields are not affected and do not need to take action.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-11-13
Last Modified
2025-11-13
Generated
2026-05-07
AI Q&A
2025-11-14
EPSS Evaluated
2026-05-05
NVD
Affected Vendors & Products
Showing 4 associated CPEs
Vendor Product Version / Range
apollo apollo_federation 2.10.4
apollo apollo_federation 2.12.1
apollo apollo_federation 2.11.5
apollo apollo_federation 2.9.5
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-288 The product requires authentication, but the product has an alternate path or channel that does not require authentication.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability affects Apollo Federation's composition logic before certain fixed versions. It allows some queries to Apollo Router to bypass access controls on types and fields. Specifically, user-defined access control directives on interface types or fields can be bypassed by querying the implementing object types or fields using inline fragments. The issue arises because Apollo Federation incorrectly allowed access control directives on interface types/fields, which could be circumvented. The fix disallows user-defined access control directives on interface types and fields to prevent this bypass.


How can this vulnerability impact me? :

This vulnerability can lead to unauthorized access to data by bypassing access controls on certain API types and fields in Apollo Router. Attackers or unauthorized users could query data they should not have access to by exploiting the bypass on interface types/fields. This could result in exposure of sensitive information or data leakage.


What immediate steps should I take to mitigate this vulnerability?

To mitigate this vulnerability, upgrade Apollo Federation composition logic to versions 2.9.5, 2.10.4, 2.11.5, or 2.12.1 or later. If you are using Apollo Rover with an unpatched composition version or Apollo Studio build pipeline with Federation version 2.8 or below, manually copy the access control requirements from interface types/fields to each implementing object type/field where appropriate. Do not remove access control requirements from interface types/fields, as unpatched Apollo Composition will not generate them automatically. If you are not using Apollo Router access control features or not specifying access control on interface types/fields, no action is needed.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart