Security Digest: November 6, 2025 - 3 Critical Vulnerabilities

Today, three critical vulnerabilities have been identified that require immediate action. Two vulnerabilities in Apollo Router could allow unauthorized data access, while a flaw in containerd permissions may expose sensitive data and escalate privileges.

· 3 min read

Urgent Security Update: Address These Critical Vulnerabilities Now

Executive Summary

Today, three critical vulnerabilities have been identified that require immediate action. Two vulnerabilities in Apollo Router could allow unauthorized data access, while a flaw in containerd permissions may expose sensitive data and escalate privileges. Update your systems immediately to mitigate these risks.

Critical Vulnerabilities

CVE-2025-64173: Unauthorized Query Access via Apollo Router

  • Impact: Attackers can bypass access controls to retrieve sensitive data.
  • Affected Systems: Apollo Router versions predating 1.61.12 and 2.8.1
  • Immediate Action: Update to Apollo Router versions 1.61.12+ or 2.8.1+.
  • Mitigation: Apply access control directives consistently across both interface and object types if updates are delayed.

CVE-2025-64347: Unchecked Schema Element Access in Apollo Router

  • Impact: Unauthorized queries can bypass access control on renamed schema elements.
  • Affected Systems: Apollo Router using renamed access control directives via `@link`
  • Immediate Action: Upgrade to Apollo Router versions 1.61.12+ or 2.8.1+.
  • Mitigation: Avoid renaming access control directives until the update is applied.

CVE-2024-25621: Excessive Permissions in containerd

  • Impact: Local users can access critical directories and potentially escalate privileges.
  • Affected Systems: containerd versions prior to 2.2.0, 2.1.5, 2.0.7, and 1.7.29
  • Immediate Action: Update to the latest containerd versions: 2.2.0, 2.1.5, 2.0.7, or 1.7.29.
  • Mitigation: Manually set directory permissions to 700 or run containerd in rootless mode.

What to Do Now

  1. Immediately update Apollo Router and containerd to the specified versions.
  2. Verify that access control directives are applied correctly in Apollo Router.
  3. Ensure directory permissions in containerd are correctly set to 700.
  4. Continuously monitor for any unauthorized access attempts or anomalies.

Related Resources

  • Refer to the official Apollo Router and containerd advisories for detailed patch information.
  • Check our upcoming blog post on securing GraphQL interfaces for more insights.

Keep reading