TI-2026-27681 CVE-2026-35577
Missing Host Header Validation in Apollo MCP Server for Localhost Deployments
Priority LOW 36
Apollo MCP Server is a Model Context Protocol server that exposes GraphQL operations as MCP tools.
Vulnerabilities
20 records
TI-2026-19253 CVE-2026-23897 · GHSA-mp6q-xf9x-fwf7
Apollo Server is vulnerable to denial of service with `startStandaloneServer`
Priority MEDIUM 40
Apollo Server is an open-source, spec-compliant GraphQL server that's compatible with any GraphQL client, including Apollo Client.
TI-2025-39920 CVE-2025-64530 · GHSA-mx7m-j9xf-62hw
@apollo/composition has Improper Enforcement of Access Control on Interface Types and Fields
Priority LOW 33
Apollo Federation is an architecture for declaratively composing APIs into a unified graph.
TI-2025-39780 CVE-2025-64347 · GHSA-g8jh-vg5j-4h3f
Apollo Router Improperly Enforces Renamed Access Control Directives
Priority LOW 39
Apollo Router Core is a configurable Rust graph router written to run a federated supergraph using Apollo Federation 2.
TI-2025-39616 CVE-2025-64173 · GHSA-x33c-7c2v-mrj9
Apollo Router Core: Access Control Bypass on Polymorphic Types
Priority LOW 39
Apollo Router Core is a configurable graph router written in Rust to run a federated supergraph using Apollo Federation 2.
TI-2025-37284 CVE-2025-59845 · GHSA-w87v-7w53-wwxv
Apollo Embedded Sandbox and Explorer vulnerable to CSRF via window.postMessage origin-validation bypass
Priority LOW 35
Apollo Studio Embeddable Explorer & Embeddable Sandbox are website embeddable software solutions from Apollo GraphQL.
TI-2025-23459 CVE-2025-32380 · GHSA-3j43-9v8v-cp3f
Apollo Router Query Validation Vulnerable to Excessive Resource Consumption via Named Fragment Processing
Priority LOW 34
The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2.
TI-2025-23158 CVE-2025-32034 · GHSA-75m2-jhh5-j5g2
Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment Expansion
Priority MEDIUM 40
The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2.
TI-2025-23157 CVE-2025-32033 · GHSA-84m6-5m72-45fp
Apollo Router Operation Limits Vulnerable to Bypass via Integer Overflow
Priority MEDIUM 40
The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2.
TI-2025-23156 CVE-2025-32032 · GHSA-94hh-jmq8-2fgp
Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Optimization Bypass
Priority MEDIUM 40
The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2.
TI-2025-23155 CVE-2025-32031 · GHSA-p2q6-pwh5-m6jr
Apollo Gateway Query Planner Vulnerable to Excessive Resource Consumption via Optimization Bypass
Priority MEDIUM 40
Apollo Gateway provides utilities for combining multiple GraphQL microservices into a single GraphQL endpoint.
TI-2025-23154 CVE-2025-32030 · GHSA-q2f9-x4p4-7xmh
Apollo Gateway Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment Expansion
Priority LOW 39
Apollo Gateway provides utilities for combining multiple GraphQL microservices into a single GraphQL endpoint.
TI-2025-22676 CVE-2025-31496 · GHSA-7mpv-9xg6-5r79
apollo-compiler Named Fragment Processing Vulnerability
Priority LOW 39
apollo-compiler is a query-based compiler for the GraphQL query language.
TI-2024-29063 CVE-2024-43414 · GHSA-fmj9-77q8-g6c4
Apollo Query Planner and Apollo Gateway may infinitely loop on sufficiently complex queries
Priority MEDIUM 41
Apollo Federation is an architecture for declaratively composing APIs into a unified graph.
TI-2024-29378 CVE-2024-43783 · GHSA-x6xq-whh3-gg32
Apollo Router Coprocessors may cause Denial-of-Service when handling request bodies
Priority MEDIUM 40
The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2.
TI-2024-21837 CVE-2024-32971 · GHSA-q9p4-hw9m-fj2v
Defect in query plan cache may cause incorrect operations to be executed in Apollo Router
Priority MEDIUM 42
Apollo Router is a configurable, graph router written in Rust to run a federated supergraph that uses Apollo Federation 2.
TI-2024-18682 CVE-2024-28101 · GHSA-cgqf-3cq5-wvcj
Apollo Router's Compressed Payloads do not respect HTTP Payload Limits
Priority MEDIUM 40
The Apollo Router is a graph router written in Rust to run a federated supergraph that uses Apollo Federation.
TI-2024-15835 CVE-2024-23841 · GHSA-rv8p-rr2h-fgpg
XSS in @apollo/experimental-nextjs-app-support
Priority LOW 36
apollo-client-nextjs is the Apollo Client support for the Next.js App Router.
TI-2023-24573 CVE-2023-45812 · GHSA-r344-xw3p-2frj
Improper Check or Handling of Exceptional Conditions in apollo-router
Priority MEDIUM 40
The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation.
TI-2023-21917 CVE-2023-41317 · GHSA-w8vq-3hf9-xppx
Unnamed "Subscription" operation results in Denial-of-Service in apollographql/router
Priority MEDIUM 40
The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2.