CVE-2026-32621: Apollo Federation prototype pollution via incomplete key sanitization

CVE-2026-32621 · Severity: low · CVSS 3.1 · Published 2026-03-13

Apollo Federation is a JavaScript library for building federated GraphQL APIs. A prototype pollution vulnerability in query plan execution allows attackers to corrupt shared object properties in the Node.js process, potentially leading to privilege escalation, data tampering, or unexpected application behavior affecting all subsequent requests to the gateway.

Vendors: Apollo.

Quick answers

Is CVE-2026-32621 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-32621 being exploited in the wild.
How severe is CVE-2026-32621?
Low severity, with a CVSS score of 3.1, published 13 March 2026.
Which products and versions are affected?
Apollo Federation-Internals all versions before 2.9.6; 2.10.0 before 2.10.5; 2.11.0 before 2.11.6; 2.12.0 before 2.12.3; 2.13.0 before 2.13.2; Apollo Query Planner all versions before 2.9.6; 2.10.0 before 2.10.5; 2.11.0 before 2.11.6; 2.12.0 before 2.12.3; 2.13.0 before 2.13.2.
Is there a fix for CVE-2026-32621?
A patch was published on 2026-03-13: Patches released in versions 2.9.6, 2.10.5, 2.11.6, 2.12.3, and 2.13.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-32621 attacked?
It is attacked over the network.
Am I affected by CVE-2026-32621?
Check whether you run Apollo Federation-Internals or Apollo Query Planner at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a prototype pollution vulnerability (CWE-1321) in Apollo Federation's query plan execution engine caused by incomplete sanitization of GraphQL field aliases and variable names. An authenticated attacker can inject crafted operations targeting prototype-inheritable properties like __proto__, constructor, or prototype. Alternatively, a compromised subgraph can send malicious JSON payloads to pollute Object.prototype in the gateway. Since Object.prototype is shared across the Node.js process, successful exploitation affects all subsequent requests and can result in code execution, privilege escalation, or data integrity violations depending on how polluted properties are consumed by the application or dependencies. Patches are available in @apollo/federation-internals, @apollo/gateway, and @apollo/query-planner versions 2.9.6, 2.10.5, 2.11.6, 2.12.3, and 2.13.2.

Affected products

  • Apollo federation-internals all versions before 2.9.6; 2.10.0 before 2.10.5; 2.11.0 before 2.11.6; 2.12.0 before 2.12.3; 2.13.0 before 2.13.2
  • Apollo gateway all versions before 2.9.6; 2.10.0 before 2.10.5; 2.11.0 before 2.11.6; 2.12.0 before 2.12.3; 2.13.0 before 2.13.2
  • Apollo query-planner all versions before 2.9.6; 2.10.0 before 2.10.5; 2.11.0 before 2.11.6; 2.12.0 before 2.12.3; 2.13.0 before 2.13.2

Identifiers

  • CVE-2026-32621
  • GHSA-pfjj-6f4p-rvmh

Timeline

  • 2026-03-13: disclosed: GHSA-pfjj-6f4p-rvmh published
  • 2026-03-13: patched: Patches released in versions 2.9.6, 2.10.5, 2.11.6, 2.12.3, and 2.13.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.