AIKIDO-2026-100091

TL;DR

Apollo Router validates the structure of a supergraph schema when it loads it, but does not validate that the GraphQL values embedded in that schema are valid for it. Native composition can produce a supergraph in which a field-argument default value references an @inaccessible input-object field, and the router accepts it without error while API schema validation still passes. The value of the @inaccessible field is then exposed to clients through the computed API schema and introspection, defeating the concealment the directive is meant to provide. The fix validates GraphQL values during composition so defaults referencing inaccessible input fields no longer leak.