AIKIDO-2026-932755

TL;DR

Apollo Router validates GraphQL variable values during coercion against the internal supergraph schema instead of the client-facing API schema. A client can reference an @inaccessible input-object field or supply an @inaccessible enum value through a variable and have it accepted and forwarded to the responsible subgraph, even though the same reference is rejected when written directly in the operation document. This bypasses the access-control boundary that @inaccessible is meant to enforce on operation inputs, and strict_variable_validation does not mitigate it. The fix validates variable coercion against the API schema and rejects input-object variable fields that are not part of the public schema.