CVE-2025-64347

A vulnerability in Apollo Router allowed for unauthorized access to protected data through schema elements with access control directives (@authenticated, @requiresScopes, and @policy) that were renamed via @link imports. Router did not enforce renamed access control directives on schema elements (e.g. fields and types), allowing queries to bypass those element-level access controls.

Details

Apollo Federation allows users to specify access control directives (@authenticated, @requiresScopes, and @policy](https://www.apollographql.com/docs/graphos/routing/security/authorization#authorization-directives)) to protect schema data access at the element level. These directives can optionally be renamed via the imports argument to the @link directive, which can be useful if their default names match an existing user-defined directive in their subgraph schema. However, Apollo Router's access control logic ignored the imports argument, and would accordingly ignore access control directives that were renamed in this way.

Who Is Impacted

This vulnerability impacts Apollo Router customers defining @authenticated, @requiresScopes, or @policy directives on schema elements that were renamed via @link imports are impacted.

Scope of Impact

The vulnerability could allow a malicious actor to craft a query that can bypass access control requirements on schema elements protected by renamed access control directives.

Workarounds

• If you are not immediately updating Router to a patched version, you should remove any renames of access control directives in the imports argument to the @link directive.
• Customers not using Apollo Router with renamed access control directives (@authenticated, @requiresScopes, and @policy) are not affected and do not need to take action.

CVE-2025-64347 has a CVSS score of 7.5 (High). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (1.61.12, 2.8.1); upgrading removes the vulnerable code path.

Kodem intelligence

This vulnerability has been fixed in Apollo Router by updating the access control logic to handle the imports argument in @link directives. You will need to update Router to one of the following versions:

• 1.61.12+
• 2.8.1+

1. What is CVE-2025-64347? CVE-2025-64347 is a high-severity security vulnerability in apollo-router (rust), affecting versions < 1.61.12. It is fixed in 1.61.12, 2.8.1.
2. How severe is CVE-2025-64347? CVE-2025-64347 has a CVSS score of 7.5 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of apollo-router are affected by CVE-2025-64347? apollo-router (rust) versions < 1.61.12 is affected.
4. Is there a fix for CVE-2025-64347? Yes. CVE-2025-64347 is fixed in 1.61.12, 2.8.1. Upgrade to this version or later.
5. Is CVE-2025-64347 exploitable, and should I be worried? Whether CVE-2025-64347 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2025-64347 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2025-64347?
   • Upgrade apollo-router to 1.61.12 or later
   • Upgrade apollo-router to 2.8.1 or later