CVE-2025-64347: Apollo Router Auth Bypass Vulnerability

CVE-2025-64347 Overview

Apollo Router Core, a configurable Rust-based graph router designed to operate federated supergraphs using Apollo Federation 2, contains an authorization bypass vulnerability. The flaw allows unauthorized access to protected data when schema elements with access control directives (@authenticated, @requiresScopes, and @policy) are renamed via @link imports. The router fails to enforce these renamed access control directives on schema elements such as fields and types, enabling attackers to craft queries that bypass element-level access controls.

Critical Impact
Attackers can bypass authentication and authorization controls to access protected GraphQL schema elements, potentially exposing sensitive data without proper credentials or permissions.

Affected Products

Apollo Router Core versions 1.61.12-rc.0 and below
Apollo Router Core versions 2.8.1-rc.0 and below
Apollo Federation 2 deployments using vulnerable Router versions

Discovery Timeline

2025-11-07 - CVE CVE-2025-64347 published to NVD
2025-11-12 - Last updated in NVD database

Technical Details for CVE-2025-64347

Vulnerability Analysis

This authorization bypass vulnerability (CWE-284: Improper Access Control) stems from inadequate handling of directive renames in the Apollo Router's authorization plugin. When schema designers use @link imports to rename access control directives, the router's security enforcement mechanism fails to recognize these renamed variants. This creates a critical gap where protected schema elements appear unprotected to the query execution engine, allowing unauthorized data access.

The vulnerability affects Apollo Federation 2 deployments where schema composition uses renamed directives for authentication (@authenticated), scope requirements (@requiresScopes), or custom policies (@policy). Attackers can exploit this by querying fields or types that should be protected, as the router does not correlate the renamed directives with their security enforcement logic.

Root Cause

The root cause lies in the authorization plugin's directive resolution mechanism. When directives are renamed via @link imports, the plugin continues to search for directives using their original canonical names rather than resolving the actual names used in the schema. This disconnect between schema composition and runtime authorization enforcement creates the bypass condition.

Attack Vector

The attack is network-accessible and requires no authentication or user interaction. An attacker with knowledge of the GraphQL schema can craft queries targeting fields or types protected by renamed access control directives. Since the router fails to enforce these protections, the queries execute successfully, returning data that should require authentication or specific authorization scopes.

rust

// Security patch excerpt from authenticated.rs
// Source: https://github.com/apollographql/router/commit/78e4b20a2fc26cc5f141aa47992ed85375266a2b

 use apollo_compiler::Node;
 use apollo_compiler::ast;
 use apollo_compiler::executable;
+use apollo_compiler::name;
 use apollo_compiler::schema;
 use apollo_compiler::schema::Implementers;
+use apollo_federation::link::spec::Identity;
 use tower::BoxError;
 
 use crate::json_ext::Path;

The patch introduces apollo_federation::link::spec::Identity to properly resolve directive identities regardless of renaming, ensuring security directives are enforced even when aliased.

Detection Methods for CVE-2025-64347

Indicators of Compromise

Unexpected successful GraphQL queries to fields or types that should require authentication
Query logs showing access to protected schema elements without corresponding authentication tokens
Audit trail gaps where protected data was accessed without authorization events
Queries targeting fields decorated with renamed @authenticated, @requiresScopes, or @policy directives

Detection Strategies

Review GraphQL access logs for queries accessing sensitive fields without valid JWT tokens or session credentials
Implement query depth and field-level logging to identify unauthorized access patterns
Monitor for reconnaissance-style queries that enumerate protected schema elements
Compare expected authorization enforcement against actual query execution results

Monitoring Recommendations

Enable detailed query logging in Apollo Router to capture field-level access patterns
Implement alerting on queries accessing known sensitive fields without authentication headers
Deploy anomaly detection for unusual query patterns targeting previously protected endpoints
Regularly audit schema definitions to identify renamed access control directives

How to Mitigate CVE-2025-64347

Immediate Actions Required

Upgrade Apollo Router Core to version 1.61.12 or later for the 1.x branch
Upgrade Apollo Router Core to version 2.8.1 or later for the 2.x branch
Audit GraphQL schemas for any use of renamed access control directives via @link imports
Review access logs for potential unauthorized data access prior to patching

Patch Information

Apollo has released security patches in versions 1.61.12 and 2.8.1 that properly handle directive renames in the authorization plugin. The fix ensures that access control directives are correctly identified and enforced regardless of how they are imported or renamed in the schema. Technical details are available in the GitHub Security Advisory and the commit details.

Workarounds

Avoid renaming access control directives (@authenticated, @requiresScopes, @policy) when using @link imports until patched
Implement additional authorization checks at the subgraph level as defense-in-depth
Deploy an API gateway or web application firewall with GraphQL-aware rules to enforce access controls
Use schema composition validation to detect renamed security directives

bash

# Configuration example - Upgrade Apollo Router
# Check current version
./router --version

# Download patched version (example for 2.x branch)
curl -sSL https://router.apollo.dev/download/nix/v2.8.1 | sh

# Verify upgrade
./router --version
# Expected: Apollo Router 2.8.1 or later