What is the CVSS score of CVE-2026-32621?

CVE-2026-32621 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of Prototype Pollution are affected by CVE-2026-32621?

Apollo Federation gateway deployments are vulnerable to a critical prototype pollution flaw (CVE-2026-32621) that could allow attackers to execute arbitrary code and fully compromise the gateway…. A patch is available.

Prototype Pollution CVE-2026-32621

EUVD-2026-12135 CRITICAL

Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) (CWE-1321)

2026-03-13 GitHub_M

GHSA-pfjj-6f4p-rvmh

Information Disclosure Prototype Pollution

9.9

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 28, 2026 - 21:23 vuln.today

cvss_changed

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 13, 2026 - 21:01 euvd

EUVD-2026-12135

Analysis Generated

Mar 13, 2026 - 21:01 vuln.today

CVE Published

Mar 13, 2026 - 20:29 nvd

CRITICAL 9.9

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

6 npm packages depend on @apollo/federation-internals (5 direct, 1 indirect)
1 npm packages depend on @apollo/gateway (1 direct, 0 indirect)
2 npm packages depend on @apollo/query-planner (1 direct, 1 indirect)

Ecosystem-wide dependent count for version 2.10.0 and other introduced versions.

DescriptionNVD

Apollo Federation is an architecture for declaratively composing APIs into a unified graph. Prior to 2.9.6, 2.10.5, 2.11.6, 2.12.3, and 2.13.2, a vulnerability exists in query plan execution within the gateway that may allow pollution of Object.prototype in certain scenarios. A malicious client may be able to pollute Object.prototype in gateway directly by crafting operations with field aliases and/or variable names that target prototype-inheritable properties. Alternatively, if a subgraph were to be compromised by a malicious actor, they may be able to pollute Object.prototype in gateway by crafting JSON response payloads that target prototype-inheritable properties. This vulnerability is fixed in 2.9.6, 2.10.5, 2.11.6, 2.12.3, and 2.13.2.

AnalysisAI

Prototype pollution in Apollo Federation before multiple versions.

RemediationAI

Within 24 hours: Identify all Apollo Federation gateway instances running versions prior to 2.9.6, 2.10.5, 2.11.6, 2.12.3, and 2.13.2; document business criticality and exposure. Within 7 days: Implement network segmentation to restrict gateway access, deploy WAF rules to block suspicious GraphQL query patterns targeting prototype chain properties, and disable subgraph federation if operationally feasible. …

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

CVE-2026-32621 vulnerability details – vuln.today

Back