CVE-2025-64347: Apollo Router Improperly Enforces Renamed Access Control Directives

November 6, 2025 (updated November 7, 2025)

A vulnerability in Apollo Router allowed for unauthorized access to protected data through schema elements with access control directives (@authenticated, @requiresScopes, and @policy) that were renamed via @link imports. Router did not enforce renamed access control directives on schema elements (e.g. fields and types), allowing queries to bypass those element-level access controls.

References

github.com/advisories/GHSA-g8jh-vg5j-4h3f
github.com/apollographql/router
github.com/apollographql/router/commit/78e4b20a2fc26cc5f141aa47992ed85375266a2b
github.com/apollographql/router/security/advisories/GHSA-g8jh-vg5j-4h3f
nvd.nist.gov/vuln/detail/CVE-2025-64347

Code Behaviors & Features

Detect and mitigate CVE-2025-64347 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →