Access Control Bypass in Apollo Federation by Apollo GraphQL

CVE-2025-64530

What is CVE-2025-64530?

Apollo Federation's composition logic versions prior to 2.9.5, 2.10.4, 2.11.5, and 2.12.1 contain a vulnerability that permits access control directives on interface types/fields to be circumvented. An attacker can exploit this weakness by using inline fragments in their queries targeting implementing object types/fields, thereby bypassing the intended restrictions. To mitigate this vulnerability, users must ensure they are running an updated version of Apollo Federation and manually reinforce access control requirements where needed. Moreover, those relying on unpatched versions should be aware of existing workarounds, such as duplicating access control directives to each implementing object type/field and not deleting the requirements from interface types/fields, as this does not get auto-generated in the supergraph schema by the unpatched versions.

References