7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-64347

CVE-2025-64347: Apollo Router Improperly Enforces Renamed Access Control Directives

Summary

A vulnerability in Apollo Router allowed for unauthorized access to protected data through schema elements with access control directives (@authenticated, @requiresScopes, and @policy) that were renamed via @link imports. Router did not enforce renamed access control directives on schema elements (e.g. fields and types), allowing queries to bypass those element-level access controls.

Details

Apollo Federation allows users to specify access control directives (@authenticated, @requiresScopes, and @policy](https://www.apollographql.com/docs/graphos/routing/security/authorization#authorization-directives)) to protect schema data access at the element level. These directives can optionally be renamed via the imports argument to the @link directive, which can be useful if their default names match an existing user-defined directive in their subgraph schema. However, Apollo Router's access control logic ignored the imports argument, and would accordingly ignore access control directives that were renamed in this way.

Who Is Impacted

This vulnerability impacts Apollo Router customers defining @authenticated, @requiresScopes, or @policy directives on schema elements that were renamed via @link imports are impacted.

Scope of Impact

The vulnerability could allow a malicious actor to craft a query that can bypass access control requirements on schema elements protected by renamed access control directives.

Patches

This vulnerability has been fixed in Apollo Router by updating the access control logic to handle the imports argument in @link directives. You will need to update Router to one of the following versions:

1.61.12+
2.8.1+

Workarounds

If you are not immediately updating Router to a patched version, you should remove any renames of access control directives in the imports argument to the @link directive.
Customers not using Apollo Router with renamed access control directives (@authenticated, @requiresScopes, and @policy) are not affected and do not need to take action.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-64347

CVE-2025-64347:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
apollo-router	rust	< 1.61.12	1.61.12
apollo-router	rust	>= 2.0.0-alpha.0, < 2.8.1	2.8.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in Apollo Router's authorization logic, specifically in how it handles access control directives (@authenticated, @requiresScopes, @policy) that are renamed using the import argument of the @link directive. The root cause lies in the apollo_router::spec::schema::Schema::directive_name and apollo_router::spec::schema::Schema::has_spec functions. These functions contained flawed logic that manually parsed @link directive URLs and only accounted for renaming via the as argument, completely ignoring the import argument which is used for renaming individual directives.

When a GraphQL query is processed, the router's authorization plugin creates 'visitor' objects (e.g., AuthenticatedVisitor, PolicyFilteringVisitor) to traverse the query and schema, enforcing the declared access controls. The constructors for these visitors, such as AuthenticatedVisitor::new, call Schema::directive_name to determine the correct name of the authorization directive to enforce. Because the vulnerable directive_name function would return the default directive name instead of the renamed one, the visitors would fail to find the directive on the schema elements, and consequently, no access control would be enforced. This allows an attacker to craft queries that bypass authorization checks for any data protected by a renamed directive.

The patch rectifies this by removing the faulty manual parsing logic and instead utilizing the apollo-federation crate, which correctly interprets the full semantics of the @link directive, including the import argument. This ensures that the authorization system is always aware of the correct directive names, even when they are renamed.

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

7.5

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-64347: Apollo Router Improperly Enforces Renamed Access Control Directives

Summary

Details

Who Is Impacted

Scope of Impact

Patches

Workarounds

CVE-2025-64347:

7.5

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Basic Information

Basic Information

CVE-2025-64347: Apollo Router Improperly Enforces Renamed Access Control Directives

Summary

Details

Who Is Impacted

Scope of Impact

Patches

Workarounds

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

7.5

7.5

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI