Skip to content
OpenAdvisories

Vendor

apollographql

20 known vulnerabilities.

Products

router 11 federation 4 apollo-mcp-server 1 embeddable-explorer 1 apollo-server 1 apollo-rs 1 apollo-client-nextjs 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 6.8
    CVE-2026-35577

    Missing Host Header Validation in Apollo MCP Server for Localhost Deployments

    Apollo MCP Server is a Model Context Protocol server that exposes GraphQL operations as MCP tools. Prior to version 1.7.0, the Apollo MCP Server did not validate the Host header on incoming HTTP requests when using StreamableHTTP transport. In configurations …

    apollographql apollo-mcp-server