CVE-2025-64173: Apollo Router Auth Bypass Vulnerability

CVE-2025-64173 Overview

Apollo Router Core, a configurable graph router written in Rust designed to run federated supergraphs using Apollo Federation 2, contains an authorization bypass vulnerability. The flaw exists in versions prior to 1.61.12 and versions 2.0.0-alpha.0 through 2.8.1-rc.0, where unauthenticated queries could access data that should require additional access controls.

The vulnerability stems from how the Router incorrectly handles access control directives on interface types/fields and their implementing object types/fields. Specifically, the Router applies directives to interface types/fields while ignoring directives on their implementing object types/fields when all implementations have the same requirements.

Critical Impact

Unauthenticated attackers can bypass access controls to retrieve sensitive data from GraphQL APIs that should be protected by @authenticated, @requiresScopes, or @policy directives on polymorphic types.

Affected Products

• Apollo Router Core versions prior to 1.61.12
• Apollo Router Core versions 2.0.0-alpha.0 through 2.8.1-rc.0
• Deployments using authorization directives inconsistently on polymorphic types (object types implementing interface types)

Discovery Timeline

• 2025-11-06 - CVE-2025-64173 published to NVD
• 2025-11-12 - Last updated in NVD database

Technical Details for CVE-2025-64173

Vulnerability Analysis

This authorization bypass vulnerability (CWE-288: Authentication Bypass Using an Alternate Path or Channel) affects Apollo Router's handling of GraphQL schema directives used for access control. The core issue lies in the router's inconsistent evaluation of authorization directives across polymorphic type hierarchies in the GraphQL schema.

When developers define @authenticated, @requiresScopes, or @policy directives on object types that implement interface types, the Router fails to properly enforce these directives during query resolution. Instead, it only evaluates directives applied at the interface level, creating a path for unauthorized data access.

This vulnerability can be exploited over the network without any authentication or user interaction, potentially exposing confidential data protected by access control mechanisms.

Root Cause

The root cause is improper access control directive evaluation in Apollo Router's query planning and execution logic. When processing queries against polymorphic types (interfaces with multiple implementing object types), the Router's authorization layer evaluates only the interface-level directives. It incorrectly assumes that if all implementing types have the same authorization requirements, those requirements are enforced—when in reality, the directives on individual object types are being ignored.

Attack Vector

The attack vector is network-based and requires no authentication or privileges. An attacker can craft GraphQL queries targeting object types that implement interfaces where:

1. The interface type does not have authorization directives, or has different directives than its implementations
2. The implementing object types define @authenticated, @requiresScopes, or @policy directives that should restrict access

The attacker sends unauthenticated queries that resolve through the interface to the underlying object types. Because the Router fails to enforce the object-level authorization directives, the query returns sensitive data that should be protected.

For example, if an interface User is implemented by AdminUser with @authenticated directive, queries through the User interface may bypass the authentication requirement entirely. See the GitHub Security Advisory for detailed exploitation scenarios.

Detection Methods for CVE-2025-64173

Indicators of Compromise

• Unusual volume of GraphQL queries accessing protected fields without valid authentication tokens
• Query logs showing access to object types with authorization directives through interface type queries
• Authentication/authorization audit logs showing discrepancies between expected and actual access patterns
• Unexpected data exposure in API response logs for queries that should require authentication

Detection Strategies

• Review GraphQL query logs for queries targeting interface types that resolve to protected object implementations
• Implement monitoring for GraphQL operations that access sensitive fields without corresponding authentication headers
• Audit GraphQL schema for inconsistent authorization directive placement between interfaces and implementing types
• Deploy intrusion detection rules to flag high-frequency queries against known protected data types

Monitoring Recommendations

• Enable detailed request logging on Apollo Router to capture full query structures and authentication state
• Configure alerting for GraphQL operations accessing sensitive business data without JWT tokens or session credentials
• Monitor for anomalous query patterns that systematically probe interface-to-object type relationships
• Implement real-time comparison of requested data sensitivity versus provided authentication credentials

How to Mitigate CVE-2025-64173

Immediate Actions Required

• Upgrade Apollo Router Core to version 1.61.12 or 2.8.1 immediately
• Audit all GraphQL schemas for authorization directive placement on polymorphic types
• Review access logs for potential unauthorized data access prior to patching
• Temporarily disable public access to sensitive GraphQL endpoints if immediate patching is not possible

Patch Information

Apollo has released patched versions that correctly enforce authorization directives on both interface types and their implementing object types:

• Version 1.61.12 - Fixes the vulnerability for the 1.x release line
• Version 2.8.1 - Fixes the vulnerability for the 2.x release line

Patches are available via the Apollo Router GitHub Releases. Review the GitHub Security Advisory GHSA-x33c-7c2v-mrj9 for complete details. Additionally, consult the Apollo GraphQL Authorization Guide for best practices on directive usage.

Workarounds

• Apply authorization directives consistently at both interface and object type levels to ensure redundant enforcement
• Implement network-level access controls (WAF rules, IP allowlisting) to restrict access to sensitive GraphQL endpoints
• Add middleware or gateway-level authentication checks before requests reach the Apollo Router
• Temporarily remove interface types from the public schema, exposing only concrete object types with proper directives

# Configuration example: Verify Apollo Router version and upgrade
# Check current version
./router --version

# Upgrade to patched version using your package manager or container image
# For 1.x line:
# docker pull ghcr.io/apollographql/router:v1.61.12
# For 2.x line:
# docker pull ghcr.io/apollographql/router:v2.8.1