Executive brief
Apollo Federation is a GraphQL API composition framework that allows organizations to build federated graph architectures. The vulnerability allows attackers to bypass field-level access controls by indirectly querying protected data through dependent fields marked with @requires or @fromContext directives, potentially exposing sensitive information that should be restricted by authentication or authorization policies.
Technical details
The vulnerability is an access control bypass (CWE-863) in Apollo Federation's composition logic. Protected fields decorated with @authenticated, @requiresScopes, or @policy directives can be accessed indirectly as transitive dependencies of other fields using @requires or @fromContext without enforcing the same access control requirements. At runtime, Apollo Router fetches dependency fields from subgraphs without validating their individual access control directives when those fields are not explicitly queried. An attacker with network access to a federated GraphQL endpoint can craft queries that retrieve protected field values indirectly, bypassing the intended access control checks. Patches are available in @apollo/composition versions 2.9.5+, 2.10.4+, 2.11.5+, and 2.12.1+, though this requires schema updates to enforce matching access control directives on dependent fields.
Affected products
- Apollo @apollo/composition < 2.9.5, < 2.10.4, < 2.11.5, < 2.12.1
Timeline
- 2025-11-14: disclosed