Is CVE-2025-64530 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-64530 being exploited in the wild.

How severe is CVE-2025-64530?

High severity, with a CVSS score of 7.5, published 13 November 2025.

Which products and versions are affected?

Apollo Composition before 2.9.5, 2.10.0-alpha.3 to before 2.10.4, 2.11.0 to before 2.11.5, 2.12.0 to before 2.12.1.

Is there a fix for CVE-2025-64530?

A patch was published on 2025-11-14: Fixed in versions 2.9.5, 2.10.4, 2.11.5, 2.12.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-64530 attacked?

It is attacked over the network.

Am I affected by CVE-2025-64530?

Check whether you run Apollo Composition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-64530: Apollo composition access control bypass on interface types and fields

CVE-2025-64530 · Severity: high · CVSS 7.5 · Published 2025-11-13

Apollo Federation is a system that combines multiple GraphQL services into a unified API. This vulnerability allows attackers to bypass access control policies by querying implementing object types instead of protected interface types, potentially exposing data that should have been restricted. Organizations using Apollo Router with access control directives on interface types are at risk of unauthorized data exposure.

Vendors: Apollo.

Quick answers

Is CVE-2025-64530 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-64530 being exploited in the wild.
How severe is CVE-2025-64530?: High severity, with a CVSS score of 7.5, published 13 November 2025.
Which products and versions are affected?: Apollo Composition before 2.9.5, 2.10.0-alpha.3 to before 2.10.4, 2.11.0 to before 2.11.5, 2.12.0 to before 2.12.1.
Is there a fix for CVE-2025-64530?: A patch was published on 2025-11-14: Fixed in versions 2.9.5, 2.10.4, 2.11.5, 2.12.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-64530 attacked?: It is attacked over the network.
Am I affected by CVE-2025-64530?: Check whether you run Apollo Composition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an improper access control enforcement (CWE-284, CWE-288) in Apollo Composition's federation logic. Apollo Router enforces access control directives (@authenticated, @requiresScopes, @policy) on object and interface types/fields, but the GraphQL specification does not define directive inheritance rules. An attacker can bypass interface-level access controls by crafting queries using inline or named fragments to query the implementing object types/fields directly, which do not inherit the interface's access control requirements. The vulnerability affects all versions prior to 2.9.5, 2.10.4, 2.11.5, and 2.12.1. The fix rejects user-defined access control directives on interface types/fields and automatically generates them for implementations.

Affected products

Apollo composition before 2.9.5, 2.10.0-alpha.3 to before 2.10.4, 2.11.0 to before 2.11.5, 2.12.0 to before 2.12.1

Identifiers

CVE-2025-64530
GHSA-mx7m-j9xf-62hw

Timeline

2025-11-13: disclosed: Vulnerability published on NVD
2025-11-14: advisory: GitHub security advisory published
2025-11-14: patched: Fixed in versions 2.9.5, 2.10.4, 2.11.5, 2.12.1

References

https://github.com/apollographql/federation/security/advisories/GHSA-mx7m-j9xf-62hw

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.