CVE-2025-64347: 
Rust vulnerability analysis and mitigation

Apollo Router Core, a configurable Rust graph router for federated supergraph using Apollo Federation 2, was found to contain a security vulnerability (CVE-2025-64347) that allowed unauthorized access to protected data. The vulnerability affected versions 1.61.12-rc.0 and below, and 2.8.1-rc.0, where access control directives (@authenticated, @requiresScopes, and @policy) that were renamed via @link imports were not properly enforced. This vulnerability was discovered and disclosed on November 5, 2025 (GitHub Advisory).

The vulnerability stems from Apollo Router's access control logic failing to handle the imports argument in @link directives properly. When access control directives were renamed using the @link directive's imports argument, the router would ignore these renamed directives entirely, effectively bypassing the access control requirements on protected schema elements. The vulnerability has been assigned a CVSS v3.1 score of 7.5 (High) with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating a network-accessible vulnerability requiring no privileges or user interaction to exploit (GitHub Advisory).

The vulnerability could allow malicious actors to bypass access control requirements on schema elements that were protected by renamed access control directives. This could lead to unauthorized access to protected data, potentially exposing sensitive information that should have been restricted by the authentication and authorization controls (GitHub Advisory).

The vulnerability has been fixed in Apollo Router versions 1.61.12 and 2.8.1 by updating the access control logic to properly handle the imports argument in @link directives. For users unable to immediately update to a patched version, a workaround is available by removing any renames of access control directives in the imports argument to the @link directive. Users not using Apollo Router with renamed access control directives are not affected and require no action (GitHub Advisory).