CVE-2025-64173: apollographql router · Authentication Bypass Using an Alternate Path or Channel
Affects apollographql routerSource CVE Database V5
Not known to be exploited · CVSS 7.5 High : upgrade to 2.8.1 or 1.61.12 soon.
Data as of 26 Oct 2026, 07:57 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 27% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 2.8.1, 1.61.12
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 6 Nov 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.
What to do
Upgrade github/apollographql/router to 2.8.1 or 1.61.12.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
crates.iogithub/apollographql/routerpkg:cargo/github/apollographql/routerOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
To mitigate CVE-2025-64173, European organizations should immediately upgrade Apollo Router to version 1.61.12 or later, or 2.8.1 or later, where the vulnerability is patched. Beyond patching, organizations must audit their GraphQL schema definitions to ensure consistent application of access control directives (@authenticated, @requiresScopes, @policy) across interface types and all their implementing object types. This includes reviewing polymorphic types to confirm that access controls are not solely applied at the interface level but also correctly enforced on each implementation. Implement automated schema validation tools to detect inconsistent directive usage. Additionally, employ runtime monitoring and logging of GraphQL queries to detect anomalous access patterns that may indicate exploitation attempts. Network-level protections such as Web Application Firewalls (WAFs) can be tuned to detect and block suspicious GraphQL queries. Finally, conduct security awareness training for developers on secure GraphQL schema design and access control best practices to prevent similar issues in future deployments.
Description
Apollo Router Core is a configurable graph router written in Rust to run a federated supergraph using Apollo Federation 2. In versions 1.61.11 below, as well as 2.0.0-alpha.0 through 2.8.1-rc.0, a vulnerability allowed for unauthenticated queries to access data that required additional access controls. Router incorrectly handled access control directives on interface types/fields and their implementing object types/fields, applying them to interface types/fields while ignoring directives on their implementing object types/fields when all implementations had the same requirements. Apollo Router customers defining @authenticated, @requiresScopes, or @policy directives inconsistently on polymorphic types (i.e., object types that implement interface types) are impacted. This issue is fixed in versions 1.61.12 and 2.8.1.