Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-2uj7-rxbc-7bh4
Vulnerability ID VCID-2uj7-rxbc-7bh4
Aliases CVE-2025-64530
GHSA-mx7m-j9xf-62hw
Summary Apollo Federation is an architecture for declaratively composing APIs into a unified graph. A vulnerability in versions of Apollo Federation's composition logic prior to 2.9.5, 2.10.4, 2.11.5, and 2.12.1 allowed some queries to Apollo Router to improperly bypass access controls on types/fields. Apollo Federation incorrectly allowed user-defined access control directives on interface types/fields, which could be bypassed by instead querying the implementing object types/fields in Apollo Router via inline fragments, for example. A fix to versions 2.9.5, 2.10.4, 2.11.5, and 2.12.1 of composition logic in Federation now disallows interfaces types and fields to contain user-defined access control directives. Some workarounds are available. Users of Apollo Rover with an unpatched composition version or are using the Apollo Studio build pipeline with Federation version 2.8 or below should manually copy the access control requirements on interface types/fields to each implementing object type/field where appropriate. Do not remove those access control requirements from the interface types/fields, as unpatched Apollo Composition will not automatically generate them in the supergraph schema. Customers not using Apollo Router access control features (`@authenticated`, `@requiresScopes`, or `@policy` directives) or not specifying access control requirements on interface types/fields are not affected and do not need to take action.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-288 Authentication Bypass Using an Alternate Path or Channel
CWE-284 Improper Access Control
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.0016 https://api.first.org/data/v1/epss?cve=CVE-2025-64530
epss 0.0016 https://api.first.org/data/v1/epss?cve=CVE-2025-64530
epss 0.0016 https://api.first.org/data/v1/epss?cve=CVE-2025-64530
epss 0.0016 https://api.first.org/data/v1/epss?cve=CVE-2025-64530
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-mx7m-j9xf-62hw
cvssv3.1 7.5 https://github.com/apollographql/federation
generic_textual HIGH https://github.com/apollographql/federation
cvssv3.1 7.5 https://github.com/apollographql/federation/pull/3340
generic_textual HIGH https://github.com/apollographql/federation/pull/3340
cvssv3.1 7.5 https://github.com/apollographql/federation/pull/3341
generic_textual HIGH https://github.com/apollographql/federation/pull/3341
cvssv3.1 7.5 https://github.com/apollographql/federation/pull/3343
generic_textual HIGH https://github.com/apollographql/federation/pull/3343
cvssv3.1 7.5 https://github.com/apollographql/federation/security/advisories/GHSA-mx7m-j9xf-62hw
cvssv3.1_qr HIGH https://github.com/apollographql/federation/security/advisories/GHSA-mx7m-j9xf-62hw
generic_textual HIGH https://github.com/apollographql/federation/security/advisories/GHSA-mx7m-j9xf-62hw
ssvc Track https://github.com/apollographql/federation/security/advisories/GHSA-mx7m-j9xf-62hw
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2025-64530
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2025-64530
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2025-64530
https://github.com/apollographql/federation
https://github.com/apollographql/federation/pull/3340
https://github.com/apollographql/federation/pull/3341
https://github.com/apollographql/federation/pull/3343
CVE-2025-64530 https://nvd.nist.gov/vuln/detail/CVE-2025-64530
GHSA-mx7m-j9xf-62hw https://github.com/advisories/GHSA-mx7m-j9xf-62hw
GHSA-mx7m-j9xf-62hw https://github.com/apollographql/federation/security/advisories/GHSA-mx7m-j9xf-62hw
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/apollographql/federation
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/apollographql/federation/pull/3340
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/apollographql/federation/pull/3341
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/apollographql/federation/pull/3343
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/apollographql/federation/security/advisories/GHSA-mx7m-j9xf-62hw
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-11-14T15:57:29Z/ Found at https://github.com/apollographql/federation/security/advisories/GHSA-mx7m-j9xf-62hw
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2025-64530
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.36701
EPSS Score 0.0016
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T16:57:27.263095+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2025/64xxx/CVE-2025-64530.json 38.6.0