« Volver al listado

CVE-2026-32621

Estado: AplazadaCrítica (9.9)—

Apollo Federation is an architecture for declaratively composing APIs into a unified graph. Prior to 2.9.6, 2.10.5, 2.11.6, 2.12.3, and 2.13.2, a vulnerability exists in query plan execution within the gateway that may allow pollution of Object.prototype in certain scenarios. A malicious client may be able to pollute Object.prototype in gateway directly by crafting operations with field aliases and/or variable names that target prototype-inheritable properties. Alternatively, if a subgraph were to be compromised by a malicious actor, they may be able to pollute Object.prototype in gateway by crafting JSON response payloads that target prototype-inheritable properties. This vulnerability is fixed in 2.9.6, 2.10.5, 2.11.6, 2.12.3, and 2.13.2.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Acceso de red sin privilegios (PR:L pero cliente malicioso puede actuar); contaminación de prototype permite ejecución de código arbitrario. El vector CVSS AV:N/PR:L/AC:L y CWE-1321 (prototype pollution) sustentan ejecución de comandos y manipulación de objetos en gateway.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementNetwork SegmentationVulnerability ScanningRestrict Web-Based ContentRestrict File and Directory PermissionsLimit Software Installation

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Apollo — FederationAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-32621",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-32621",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-03-16T20:14:28.668002Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9.9,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 3.1
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "@apollo",
          "product": "federation-internals",
          "versions": [
            {
              "status": "affected",
              "version": ">= 2.13.0-preview.0, < 2.13.2"
            },
            {
              "status": "affected",
              "version": ">= 2.12.0-preview.0, < 2.12.3"
            },
            {
              "status": "affected",
              "version": ">= 2.11.0-preview.0, < 2.11.6"
            },
            {
              "status": "affected",
              "version": ">= 2.10.0-alpha.0, < 2.10.5"
            },
            {
              "status": "affected",
              "version": "< 2.9.6"
            }
          ]
        },
        {
          "vendor": "@apollo",
          "product": "gateway",
          "versions": [
            {
              "status": "affected",
              "version": ">= 2.13.0-preview.0, < 2.13.2"
            },
            {
              "status": "affected",
              "version": ">= 2.12.0-preview.0, < 2.12.3"
            },
            {
              "status": "affected",
              "version": ">= 2.11.0-preview.0, < 2.11.6"
            },
            {
              "status": "affected",
              "version": ">= 2.10.0-alpha.0, < 2.10.5"
            },
            {
              "status": "affected",
              "version": "< 2.9.6"
            }
          ]
        },
        {
          "vendor": "@apollo",
          "product": "query-planner",
          "versions": [
            {
              "status": "affected",
              "version": ">= 2.13.0-preview.0, < 2.13.2"
            },
            {
              "status": "affected",
              "version": ">= 2.12.0-preview.0, < 2.12.3"
            },
            {
              "status": "affected",
              "version": ">= 2.11.0-preview.0, < 2.11.6"
            },
            {
              "status": "affected",
              "version": ">= 2.10.0-alpha.0, < 2.10.5"
            },
            {
              "status": "affected",
              "version": "< 2.9.6"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-03-16T14:19:39.797",
  "references": [
    {
      "url": "https://github.com/apollographql/federation/security/advisories/GHSA-pfjj-6f4p-rvmh",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1321"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Apollo Federation is an architecture for declaratively composing APIs into a unified graph. Prior to 2.9.6, 2.10.5, 2.11.6, 2.12.3, and 2.13.2, a vulnerability exists in query plan execution within the gateway that may allow pollution of Object.prototype in certain scenarios. A malicious client may be able to pollute Object.prototype in gateway directly by crafting operations with field aliases and/or variable names that target prototype-inheritable properties. Alternatively, if a subgraph were to be compromised by a malicious actor, they may be able to pollute Object.prototype in gateway by crafting JSON response payloads that target prototype-inheritable properties. This vulnerability is fixed in 2.9.6, 2.10.5, 2.11.6, 2.12.3, and 2.13.2."
    },
    {
      "lang": "es",
      "value": "Apollo Federation es una arquitectura para componer declarativamente APIs en un grafo unificado. Antes de 2.9.6, 2.10.5, 2.11.6, 2.12.3 y 2.13.2, existe una vulnerabilidad en la ejecución del plan de consulta dentro del gateway que puede permitir la contaminación de Object.prototype en ciertos escenarios. Un cliente malicioso puede ser capaz de contaminar Object.prototype en el gateway directamente elaborando operaciones con alias de campo y/o nombres de variables que apuntan a propiedades heredables del prototipo. Alternativamente, si un subgrafo fuera comprometido por un actor malicioso, podrían ser capaces de contaminar Object.prototype en el gateway elaborando cargas útiles de respuesta JSON que apuntan a propiedades heredables del prototipo. Esta vulnerabilidad está corregida en 2.9.6, 2.10.5, 2.11.6, 2.12.3 y 2.13.2."
    }
  ],
  "lastModified": "2026-06-17T10:36:06.943",
  "sourceIdentifier": "security-advisories@github.com"
}