github.com
https://github.com/apollographql/router CVE-2025-64347
HIGH
Apollo Router Improperly Enforces Renamed Access Control Directives
Record summary
CVE-2025-64347 has a selected CVSS score of 7.5 (high).
Description
Apollo Router Core is a configurable Rust graph router written to run a federated supergraph using Apollo Federation 2. Versions 1.61.12-rc.0 and below and 2.8.1-rc.0 allow unauthorized access to protected data through schema elements with access control directives (@authenticated, @requiresScopes, and @policy) that were renamed via @link imports. Router did not enforce renamed access control directives on schema elements (e.g. fields and types), allowing queries to bypass those element-level access controls. This issue is fixed in versions 1.61.12 and 2.8.1.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableYes
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Nov 7, 2025 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
| CVE List | < 1.61.12 | affected | |
| >= 2.8.1-rc.0, < 2.8.1 | affected | ||
apollo-routerBrowse crates.io / apollo-router | GitHub Advisory | Before 1.61.12 · Fixed in 1.61.12 | affected |
| 2.0.0-alpha.0 to < 2.8.1 · Fixed in 2.8.1 | affected |
References
4github.com
https://github.com/apollographql/router/commit/78e4b20a2fc26cc5f141aa47992ed85375266a2b github.comConfirmation
https://github.com/apollographql/router/security/advisories/GHSA-g8jh-vg5j-4h3f nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2025-64347