Read the docs
TI-2025-39780 Aliases CVE-2025-64347GHSA-g8jh-vg5j-4h3f

Apollo Router Improperly Enforces Renamed Access Control Directives

Priority LOW 39CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-284.

Summary

Apollo Router Core is a configurable Rust graph router written to run a federated supergraph using Apollo Federation 2. Versions 1.61.12-rc.0 and below and 2.8.1-rc.0 allow unauthorized access to protected data through schema elements with access control directives (@authenticated, @requiresScopes, and @policy) that were renamed via @link imports. Router did not enforce renamed access control directives on schema elements (e.g. fields and types), allowing queries to bypass those element-level access controls. This issue is fixed in versions 1.61.12 and 2.8.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00326 25th percentileScored 2026-11-07
Fix Fixed router (apollographql): 1.61.12, 2.8.1apollo-router (crates.io): 1.61.12, 2.8.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
apollographqlrouterbefore 1.61.12; 2.8.1-rc.0 to before 2.8.11.61.12, 2.8.1Patch availableCNA
—apollo-router (crates.io)before 1.61.121.61.12Patch availableGHSA-g8jh-vg5j-4h3f
—apollo-router (crates.io)2.0.0-alpha.0 to before 2.8.12.8.1Patch availableGHSA-g8jh-vg5j-4h3f
  • router Vendorapollographql Affected before 1.61.12; 2.8.1-rc.0 to before 2.8.1 Fixed in 1.61.12, 2.8.1 Patch available CNA
  • apollo-router (crates.io) Vendor— Affected before 1.61.12 Fixed in 1.61.12 Patch available GHSA-g8jh-vg5j-4h3f
  • apollo-router (crates.io) Vendor— Affected 2.0.0-alpha.0 to before 2.8.1 Fixed in 2.8.1 Patch available GHSA-g8jh-vg5j-4h3f

Remediation

  • Fix · CNA router (apollographql) Fixed in 1.61.12, 2.8.1
  • Fix · GHSA-g8jh-vg5j-4h3f apollo-router (crates.io) Fixed in 1.61.12 Advisory →
  • Fix · GHSA-g8jh-vg5j-4h3f apollo-router (crates.io) Fixed in 2.8.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-64347
  2. 2026-10-03 Alias added: GHSA-g8jh-vg5j-4h3f

References

Advisory 1

Other 3

  • TI-2024-21837 Defect in query plan cache may cause incorrect operations to be executed in Apollo Router CVSS 3.1CRITICAL 9.1
  • TI-2024-29063 Apollo Query Planner and Apollo Gateway may infinitely loop on sufficiently complex queries CVSS 3.1HIGH 7.5
  • TI-2026-19253 Apollo Server is vulnerable to denial of service with `startStandaloneServer` CVSS 3.1HIGH 7.5
  • TI-2025-23158 Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment Expansion CVSS 3.1HIGH 7.5
  • TI-2025-23157 Apollo Router Operation Limits Vulnerable to Bypass via Integer Overflow CVSS 3.1HIGH 7.5
  • TI-2025-23156 Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Optimization Bypass CVSS 3.1HIGH 7.5
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences