Detections
Analytics

SCA: security update for @apollo/composition (GHSA-mx7m-j9xf-62hw)

high Tenable Self-Hosted Container Security Plugin ID 436055

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Apollo Federation is an architecture for declaratively composing APIs into a unified graph. A
 vulnerability in versions of Apollo Federation's composition logic prior to 2.9.5, 2.10.4, 2.11.5, and
 2.12.1 allowed some queries to Apollo Router to improperly bypass access controls on types/fields. Apollo
 Federation incorrectly allowed user-defined access control directives on interface types/fields, which
 could be bypassed by instead querying the implementing object types/fields in Apollo Router via inline
 fragments, for example. A fix to versions 2.9.5, 2.10.4, 2.11.5, and 2.12.1 of composition logic in
 Federation now disallows interfaces types and fields to contain user-defined access control directives.
 Some workarounds are available. Users of Apollo Rover with an unpatched composition version or are using
 the Apollo Studio build pipeline with Federation version 2.8 or below should manually copy the access
 control requirements on interface types/fields to each implementing object type/field where appropriate.
 Do not remove those access control requirements from the interface types/fields, as unpatched Apollo
 Composition will not automatically generate them in the supergraph schema. Customers not using Apollo
 Router access control features (`@authenticated`, `@requiresScopes`, or `@policy` directives) or not
 specifying access control requirements on interface types/fields are not affected and do not need to take
 action. (CVE-2025-64530)

See Also

https://github.com/advisories/GHSA-mx7m-j9xf-62hw

Plugin Details

Severity: High

ID: 436055

Version: Revision 1.6

Type: Local

Family: SCA Checks

Published: 11/14/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.67

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N

CVSS Score Source: CVE-2025-64530

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 11/14/2025

Vulnerability Publication Date: 11/13/2025

Reference Information

CVE: CVE-2025-64530