CVE-2025-68609: Authentication Bypass by Primary Weakness

A vulnerability in Palantir's Aries service allowed unauthenticated access to log viewing and management functionality on Apollo instances using default configuration. The defect resulted in both authentication and authorization checks being bypassed, potentially allowing any network-accessible...

CVE-2023-25569

Apollo is a configuration management system. Prior to version 2.1.0, a low-privileged user can create a special web page. If an authenticated portal admin visits this page, the page can silently send a request to assign new roles for that user without any confirmation from the Portal admin. Cooki...

CVE-2023-25570

Apollo is a configuration management system. Prior to version 2.1.0, there are potential security issues if users expose apollo-configservice to the internet, which is not recommended. This is because there is no authentication feature enabled for the built-in eureka service. Malicious hackers ma...

CVE-2024-49587

Glutton V1 service endpoints were exposed without any authentication on Gotham stacks, this could have allowed users that did not have any permission to hit glutton backend directly and read/update/delete data. The affected service has been patched and automatically deployed to all Apollo-managed...

CVE-2024-49587 Glutton V1 endpoints missing authentication

Glutton V1 service endpoints were exposed without any authentication on Gotham stacks, this could have allowed users that did not have any permission to hit glutton backend directly and read/update/delete data. The affected service has been patched and automatically deployed to all Apollo-managed...

EUVD-2024-55358

Glutton V1 service endpoints were exposed without any authentication on Gotham stacks, this could have allowed users that did not have any permission to hit glutton backend directly and read/update/delete data. The affected service has been patched and automatically deployed to all Apollo-managed...

CVE-2024-49587

CVE-2024-49587 concerns Glutton V1: unauthenticated endpoints on Gotham stacks could let attackers access backend data (read/update/delete). The issue is confirmed across Red Hat/NVD/CVE listings and related feeds, with a documented root cause of exposed service endpoints and no user authenticati...

PT-2025-52487

Name of the Vulnerable Software and Affected Versions Glutton V1 affected versions not specified Description The Glutton V1 service had exposed endpoints on Gotham stacks without authentication. This allowed users without proper permissions to directly access the Glutton backend, potentially...

CVE-2025-64530

Apollo Federation is an architecture for declaratively composing APIs into a unified graph. A vulnerability in versions of Apollo Federation's composition logic prior to 2.9.5, 2.10.4, 2.11.5, and 2.12.1 allowed some queries to Apollo Router to improperly bypass access controls on types/fields...

@apollo/gateway (>=2.10.0-alpha.0, <=2.10.3), @lenne.tech/nest-server (>=10.8.3, <=11.1.13) +2 more potentially affected by unknown CVE via @apollo/composition (>=2.10.0, <=2.10.3)

@apollo/composition NPM version =2.10.0, =2.10.0-alpha.0, =10.8.3, =11.1.13 - @pothos-examples/federation 3.1.13 - @pothos-examples/prisma-federation 3.1.24 Source cves: unknown CVE Source advisory: OSV:GHSA-M8JR-FXQX-8XX6...

@apollo/gateway (>=2.3.0-beta.2, <=2.9.4), @genesisx/graphql (>=3.0.0-beta.1, <=4.0.1) +8 more potentially affected by CVE-2025-64172 via @apollo/composition (>=2.3.0, <=2.9.4)

@apollo/composition NPM version =2.3.0, =2.3.0-beta.2, =3.0.0-beta.1, =3.0.0-beta.0, =0.13.8-alpha-20230126151930-d229ec52b, =0.0.1, =9.2.0, =2.8.54, =0.0.0-preview-20230314213245, =1.3.3, =0.0.8, =1.0.48 Source cves: CVE-2025-64172 Source advisory: SNYK:JS-APOLLOCOMPOSITION-14038234...

@apollo/gateway (>=2.12.0-preview.0, <=2.12.0), @lenne.tech/nest-server (>=11.3.0, <=11.5.0) potentially affected by unknown CVE via @apollo/composition (2.12.0-preview.4)

@apollo/composition NPM version 2.12.0-preview.4 is affected by a known vulnerability. The following packages have a transitive dependency on @apollo/composition and may be impacted: - @apollo/gateway =2.12.0-preview.0, =11.3.0, =11.5.0 Source cves: unknown CVE Source advisory:...

@apollo/gateway (>=2.10.0-alpha.0, <=2.10.3), @lenne.tech/nest-server (>=10.8.3, <=11.1.13) +2 more potentially affected by CVE-2025-64172 via @apollo/composition (>=2.10.0, <=2.10.3)

@apollo/composition NPM version =2.10.0, =2.10.0-alpha.0, =10.8.3, =11.1.13 - @pothos-examples/federation 3.1.13 - @pothos-examples/prisma-federation 3.1.24 Source cves: CVE-2025-64172 Source advisory: SNYK:JS-APOLLOCOMPOSITION-14038234...

@apollo/gateway (>=2.11.0-preview.0, <=2.11.4), @dfanchon/gateway (2.11.0) +1 more potentially affected by unknown CVE via @apollo/composition (>=2.11.0, <=2.11.4)

@apollo/composition NPM version =2.11.0, =2.11.0-preview.0, =11.1.14, =11.2.0 Source cves: unknown CVE Source advisory: OSV:GHSA-M8JR-FXQX-8XX6...

@apollo/gateway (>=2.3.0-beta.2, <=2.9.4), @genesisx/graphql (>=3.0.0-beta.1, <=4.0.1) +8 more potentially affected by unknown CVE via @apollo/composition (>=2.3.0, <=2.9.4)

@apollo/composition NPM version =2.3.0, =2.3.0-beta.2, =3.0.0-beta.1, =3.0.0-beta.0, =0.13.8-alpha-20230126151930-d229ec52b, =0.0.1, =9.2.0, =2.8.54, =0.0.0-preview-20230314213245, =1.3.3, =0.0.8, =1.0.48 Source cves: unknown CVE Source advisory: OSV:GHSA-M8JR-FXQX-8XX6...

Incorrect Authorization

Overview @apollo/composition is an Apollo Federation composition utilities Affected versions of this package are vulnerable to Incorrect Authorization via the composition logic, which failed to validate that fields have the same access control requirements as the data they reference. An attacker...

@apollo/gateway (>=2.12.0-preview.0, <=2.12.0), @lenne.tech/nest-server (>=11.3.0, <=11.5.0) potentially affected by CVE-2025-64172 via @apollo/composition (2.12.0-preview.4)

@apollo/composition NPM version 2.12.0-preview.4 is affected by a known vulnerability. The following packages have a transitive dependency on @apollo/composition and may be impacted: - @apollo/gateway =2.12.0-preview.0, =11.3.0, =11.5.0 Source cves: CVE-2025-64172 Source advisory:...

EUVD-2025-197661

Apollo Federation has Improper Enforcement of Access Control on Transitive Fields...

@apollo/gateway (>=2.11.0-preview.0, <=2.11.4), @dfanchon/gateway (2.11.0) +1 more potentially affected by CVE-2025-64172 via @apollo/composition (>=2.11.0, <=2.11.4)

@apollo/composition NPM version =2.11.0, =2.11.0-preview.0, =11.1.14, =11.2.0 Source cves: CVE-2025-64172 Source advisory: SNYK:JS-APOLLOCOMPOSITION-14038234...

GHSA-M8JR-FXQX-8XX6 Apollo Federation has Improper Enforcement of Access Control on Transitive Fields

Summary A vulnerability in Apollo Federation's composition logic did not enforce that fields depending on protected data through @requires and/or @fromContext directives have the same access control requirements as the fields they reference. This allowed queries to access protected fields...