CVE-2025-64173 json
Apollo Router Core: Access Control Bypass on Polymorphic Types
published 2025-11-06 12 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-38036 , GHSA-x33c-7c2v-mrj9
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 27%
- public exploits
- 0
- none known
Summary
Apollo Router Core is a configurable graph router written in Rust to run a federated supergraph using Apollo Federation 2. In versions 1.61.11 below, as well as 2.0.0-alpha.0 through 2.8.1-rc.0, a vulnerability allowed for unauthenticated queries to access data that required additional access controls. Router incorrectly handled access control directives on interface types/fields and their implementing object types/fields, applying them to interface types/fields while ignoring directives on their implementing object types/fields when all implementations had the same requirements. Apollo Router customers defining @authenticated, @requiresScopes, or @policy directives inconsistently on polymorphic types (i.e., object types that implement interface types) are impacted. This issue is fixed in versions 1.61.12 and 2.8.1.
Patch / fix
- crates.io apollo-router 1.61.12, 2.8.1
- apollographql apollo_helms-charts_router 1.61.12, 2.8.1
- apollographql apollo_router 1.61.12, 2.8.1
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 12 mo ago
Exploit prediction
0.34% chance of exploitation in the next 30 days, higher than 27% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | apollo-router | <1.61.12 >=2.0.0-alpha.0, <2.8.1 |
1.61.12 2.8.1 |
Affected products
- apollographql router
Classification
- Weakness
-
- CWE-288 Authentication Bypass Using an Alternate Path or Channel
References
-
github.com
/apollographql/router/commit/75ca43ecb9d38423b63d09896702f9da425cc754
web
-
github.com
/apollographql/router/security/advisories/GHSA-x33c-7c2v-mrj9
web
-
github.com
/apollographql/router/releases/tag/v2.8.1
web
-
apollographql.com
/docs/graphos/routing/security/authorization#authorization-directives
web
-
nvd.nist.gov
/vuln/detail/CVE-2025-64173
advisory
-
github.com
/apollographql/router
package
Sources
- CVE List CVE-2025-64173
- GitHub Advisory GHSA-x33c-7c2v-mrj9
- NVD CVE-2025-64173
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.