{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/vendors/apollo/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.9,"id":"CVE-2026-32621"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Apollo Federation"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Apollo"],"content_html":"\u003cp\u003eCVE-2026-32621 is a critical prototype pollution vulnerability (CWE-1321) affecting Apollo Federation gateways. The vulnerability resides in the deepMerge process, where an attacker can supply specially crafted GraphQL queries containing recursive keys such as \u003cstrong\u003eproto\u003c/strong\u003e, constructor, or prototype within field aliases or variable names. By exploiting this, an attacker can modify the base Object.prototype, causing subsequent requests to inherit malicious properties. This can lead to privilege escalation, unauthorized data access, or denial of service depending on the application context. The vulnerability has been assigned a CVSS score of 9.9, and working exploit code has been publicly released, significantly increasing the risk of exploitation for unpatched instances. Organizations using Apollo Federation should prioritize patching to the provided versions immediately.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker crafts a GraphQL query containing object prototype keys like \u003cstrong\u003eproto\u003c/strong\u003e or constructor inside a field alias.\u003c/li\u003e\n\u003cli\u003eAttacker sends the malicious GraphQL query to the Apollo Gateway endpoint (e.g., /graphql) via a standard HTTP POST request.\u003c/li\u003e\n\u003cli\u003eThe Apollo Gateway receives the query and initiates the processing flow, forwarding the request to the relevant subgraph.\u003c/li\u003e\n\u003cli\u003eThe subgraph returns a JSON response containing the malicious prototype keys.\u003c/li\u003e\n\u003cli\u003eThe Apollo Gateway invokes its deepMerge() utility function to combine the response data.\u003c/li\u003e\n\u003cli\u003eThe deepMerge() function incorrectly processes the prototype keys, resulting in the injection of properties directly into the global Object.prototype.\u003c/li\u003e\n\u003cli\u003eAll subsequent operations handled by the gateway inherit the polluted properties from Object.prototype.\u003c/li\u003e\n\u003cli\u003eAttacker leverages these injected properties (e.g., isAdmin: true) to bypass authentication or execute arbitrary application logic.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows attackers to alter the application state globally, potentially leading to full compromise of the gateway's security controls. Any downstream application relying on the object's integrity is affected. Public availability of an exploit increases the likelihood of widespread automated scanning and exploitation attempts against internet-facing GraphQL endpoints.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade all Apollo Federation instances to versions 2.9.6, 2.10.5, 2.11.6, 2.12.3, or 2.13.2 immediately.\u003c/li\u003e\n\u003cli\u003eImplement request filtering at the Web Application Firewall (WAF) or API gateway layer to block GraphQL queries containing keys: \u003cstrong\u003eproto\u003c/strong\u003e, constructor, or prototype.\u003c/li\u003e\n\u003cli\u003eReview GraphQL schemas and validation logic to ensure strict adherence to allowed field aliases and variables.\u003c/li\u003e\n\u003cli\u003eUse Object.create(null) for data structures intended to hold external, untrusted input to prevent prototype inheritance.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-08-03T18:11:02Z","date_published":"2026-08-03T18:11:02Z","id":"https://feed.craftedsignal.io/briefs/2026-08-apollo-prototype-pollution/","summary":"CVE-2026-32621 is a critical prototype pollution vulnerability in Apollo Federation that allows unauthenticated attackers to manipulate application objects via malicious GraphQL queries.","title":"Critical Prototype Pollution Vulnerability in Apollo Federation","url":"https://feed.craftedsignal.io/briefs/2026-08-apollo-prototype-pollution/"}],"language":"en","title":"CraftedSignal Threat Feed - Apollo","version":"https://jsonfeed.org/version/1.1"}