CVE-2025-64347 Apollo Router Improperly Enforces Renamed Access Control Directives
Attackers can bypass access controls on renamed schema elements in Apollo Router, gaining unauthorized read access to protected data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-64347?
CVE-2025-64347 is a high-severity missing authorization vulnerability in apollographql router, published on 7 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Apollo Router Core is a configurable Rust graph router written to run a federated supergraph using Apollo Federation 2. Versions 1.61.12-rc.0 and below and 2.8.1-rc.0 allow unauthorized access to protected data through schema elements with access control directives (@authenticated, @requiresScopes, and @policy) that were renamed via @link imports. Router did not enforce renamed access control directives on schema elements (e.g. fields and types), allowing queries to bypass those element-level access controls. This issue is fixed in versions 1.61.12 and 2.8.1.
Weakness: CWE-284
Which versions are affected by CVE-2025-64347?
4 open source packages ship an affected version, including apollo-router.
| Package | Affected | Fixed in |
|---|---|---|
apollo-router crates.io | All versions | 1.61.12 |
apollo-router crates.io | All versions | 1.61.12 |
apollo-router crates.io | From 2.0.0-alpha.0 | 2.8.1 |
apollo-router crates.io | From 2.0.0-alpha.0 | 2.8.1 |
How do I fix CVE-2025-64347?
Upgrade apollo-router to a fixed version for your release line: 1.61.12 or 2.8.1.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-64347 being exploited?
There is no known exploitation of CVE-2025-64347 in the wild and no public exploit code.
Sources
Also known as GHSA-g8jh-vg5j-4h3f.