PT-2025-46925 · Apollo · Apollo Federation

Published 2025-11-13 · Updated 2025-11-14 · CVE-2025-64530

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apollo Federation versions prior to 2.9.5 Apollo Federation versions prior to 2.10.4 Apollo Federation versions prior to 2.11.5 Apollo Federation versions prior to 2.12.1

Description Apollo Federation is an architecture for composing APIs into a unified graph. A flaw in the composition logic of Apollo Federation allowed queries to bypass access controls on types and fields. Specifically, user-defined access control directives on interface types and fields could be bypassed by querying the implementing object types and fields using inline fragments in Apollo Router. The fix disallows user-defined access control directives on interface types and fields.

Recommendations Update to Apollo Federation version 2.9.5 or later. Update to Apollo Federation version 2.10.4 or later. Update to Apollo Federation version 2.11.5 or later. Update to Apollo Federation version 2.12.1 or later. For users of Apollo Rover with an unpatched composition version or using the Apollo Studio build pipeline with Federation version 2.8 or below, manually copy access control requirements from interface types/fields to each implementing object type/field. Do not remove access control requirements from interface types/fields if using an unpatched Apollo Composition version.

Exploit

Fix

Improper Access Control

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-284

CWE-288

Related Identifiers

CVE-2025-64530

GHSA-MX7M-J9XF-62HW

Affected Products

Apollo Federation

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64530.json · Exploit
• https://osv.dev/vulnerability/GHSA-mx7m-j9xf-62hw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64530 · Security Note
• https://osv.dev/vulnerability/CVE-2025-64530 · Vendor Advisory
• https://github.com/apollographql/federation · Note
• https://github.com/apollographql/federation/pull/3341 · Note
• https://github.com/apollographql/federation/pull/3340 · Note
• https://github.com/apollographql/federation/security/advisories/GHSA-mx7m-j9xf-62hw · Note
• https://github.com/apollographql/federation/pull/3343 · Note
• https://reddit.com/r/VulnMatter/comments/1ox660i/resumen_diario_de_vulnerabilidades_14112025 · Reddit Post
• https://twitter.com/CVEnew/status/1989194835342029127 · Twitter Post
• https://t.me/CVEtracker/37303 · Telegram Post