« Volver al listado

CVE-2025-64173

Estado: AplazadaAlta (7.5)—

Apollo Router Core is a configurable graph router written in Rust to run a federated supergraph using Apollo Federation 2. In versions 1.61.11 below, as well as 2.0.0-alpha.0 through 2.8.1-rc.0, a vulnerability allowed for unauthenticated queries to access data that required additional access controls. Router incorrectly handled access control directives on interface types/fields and their implementing object types/fields, applying them to interface types/fields while ignoring directives on their implementing object types/fields when all implementations had the same requirements.

Leer descripción completaMostrar menos

Apollo Router customers defining @authenticated, @requiresScopes, or @policy directives inconsistently on polymorphic types (i.e., object types that implement interface types) are impacted. This issue is fixed in versions 1.61.12 and 2.8.1.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Apollo Router expone servicio GraphQL en red sin autenticación requerida (AV:N/PR:N/UI:N). El bypass de directivas @authenticated permite acceso no autorizado a datos protegidos (C:H). CWE-288 confirma falta de autenticación.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementApplication Developer GuidanceActive Directory ConfigurationVulnerability ScanningUser TrainingUser Account Management

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Apollo — Router CoreAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-64173",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-64173",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-11-07T13:48:28.797954Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "apollographql",
          "product": "router",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.61.12"
            },
            {
              "status": "affected",
              "version": ">= 2.8.1-rc.0, < 2.8.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-11-06T21:15:43.660",
  "references": [
    {
      "url": "https://github.com/apollographql/router/releases/tag/v2.8.1",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/apollographql/router/security/advisories/GHSA-x33c-7c2v-mrj9",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://www.apollographql.com/docs/graphos/routing/security/authorization#authorization-directives",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-288"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Apollo Router Core is a configurable graph router written in Rust to run a federated supergraph using Apollo Federation 2. In versions 1.61.11 below, as well as 2.0.0-alpha.0 through 2.8.1-rc.0, a vulnerability allowed for unauthenticated queries to access data that required additional access controls. Router incorrectly handled access control directives on interface types/fields and their implementing object types/fields, applying them to interface types/fields while ignoring directives on their implementing object types/fields when all implementations had the same requirements. Apollo Router customers defining @authenticated, @requiresScopes, or @policy directives inconsistently on polymorphic types (i.e., object types that implement interface types) are impacted. This issue is fixed in versions 1.61.12 and 2.8.1."
    },
    {
      "lang": "es",
      "value": "Apollo Router Core es un router de grafos configurable escrito en Rust para ejecutar un supergrafo federado usando Apollo Federation 2. En versiones anteriores a la 1.61.11, así como de la 2.0.0-alpha.0 a la 2.8.1-rc.0, una vulnerabilidad permitía que consultas no autenticadas accedieran a datos que requerían controles de acceso adicionales. El router manejaba incorrectamente las directivas de control de acceso en tipos/campos de interfaz y sus tipos/campos de objeto implementadores, aplicándolas a los tipos/campos de interfaz mientras ignoraba las directivas en sus tipos/campos de objeto implementadores cuando todas las implementaciones tenían los mismos requisitos. Los clientes de Apollo Router que definen directivas @authenticated, @requiresScopes o @policy de manera inconsistente en tipos polimórficos (es decir, tipos de objeto que implementan tipos de interfaz) se ven afectados. Este problema está solucionado en las versiones 1.61.12 y 2.8.1."
    }
  ],
  "lastModified": "2026-06-17T09:53:57.273",
  "sourceIdentifier": "security-advisories@github.com"
}