CVE-2025-64173

Apollo Router Core is a configurable graph router written in Rust to run a federated supergraph using Apollo Federation 2. In versions 1.61.11 below, as well as 2.0.0-alpha.0 through 2.8.1-rc.0, a vulnerability allowed for unauthenticated queries to access data that required additional access controls. Router incorrectly handled access control directives on interface types/fields and their implementing object types/fields, applying them to interface types/fields while ignoring directives on their implementing object types/fields when all implementations had the same requirements. Apollo Router customers defining @authenticated, @requiresScopes, or @policy directives inconsistently on polymorphic types (i.e., object types that implement interface types) are impacted. This issue is fixed in versions 1.61.12 and 2.8.1.

• CWE-288

• https://github.com/apollographql/router/releases/tag/v2.8.1
• https://github.com/apollographql/router/security/advisories/GHSA-x33c-7c2v-mrj9
• https://www.apollographql.com/docs/graphos/routing/security/authorization#authorization-directives

Published

Nov 6, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-64167Combodo iTop is a web based IT service management tool. Vers…6.1
• CVE-2025-64168Agno is a multi-agent framework, runtime and control plane. …7.1
• CVE-2025-64169Wazuh is a free and open source platform used for threat pre…4.9
• CVE-2025-6417A vulnerability has been found in PHPGurukul Art Gallery Man…8.8
• CVE-2025-64170sudo-rs is a memory safe implementation of sudo and su writt…3.8
• CVE-2025-64171MARIN3R is a lightweight, CRD based envoy control plane for …8.7
• CVE-2025-64174Magento-lts is a long-term support alternative to Magento Co…4.8
• CVE-2025-64175Gogs is an open source self-hosted Git service. In version 0…8.8
• CVE-2025-64176ThinkDashboard is a self-hosted bookmark dashboard built wit…6.1
• CVE-2025-64177ThinkDashboard is a self-hosted bookmark dashboard built wit…6.1
• CVE-2025-64178Jellysweep is a cleanup tool for the Jellyfin media server. …8.9
• CVE-2025-64179lakeFS is an open-source tool that transforms object storage…5.3