CVEsardatanCVE-2026-118665Published Oct 28, 20:41 · Updated Oct 28, 20:41 UTC
8.2
HighCVSS 4.0 · from GitHub_M
CVE-2026-118665

GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications

graphql-tools · CWE-613 · CWE-613
Affectedgraphql-tools, executor-legacy-ws
FixNo fix listed yet.
PublishedOct 28, 20:41 · GitHub_M
ScoredOct 28 · 8.2 · GitHub_M
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:09 UTC

What we know

No known exploitation. CISA KEV, checked 22:09 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
It only works under certain conditions, which makes it harder to pull off. CVSS: high attack complexity.
A successful attack can read data. CVSS impact.

Description

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts retains request.extensions.connectionParams in the closure-scoped executorConnectionParams object after cleanupWebsocket closes a connection. When one executor is reused across different authorization contexts, a later request that omits a sensitive key can send an earlier caller's Authorization or tenant value in its connection_init payload, causing the downstream server to authenticate the later caller as the earlier user. Applications that create a new executor for every request are not affected. This issue is fixed in version 1.1.36 of the GraphQL Tools legacy WebSocket executor package.

From GitHub_M

Affected and fixed versions

ProductAffectedFixed ingraphql-tools< 9.0.36–executor-legacy-ws< 1.1.36–

Exploit code

Exploit-DBnone knownMetasploitnone knownNucleinone known

References

github.com/ardatan/graphql-tools/security/advisories/GHSA-434m-5hcj-pxf3 · github.comrefsource_CONFIRMgithub.com/ardatan/graphql-tools/pull/8480 · github.comrefsource_MISCgithub.com/ardatan/graphql-tools/commit/c2f226e6f68236be9e4a577f29faeaa92547458b · github.comrefsource_MISCgithub.com/ardatan/graphql-tools/releases/tag/@graphql-tools/[email protected] · github.comrefsource_MISC

Other CVEs in graphql-tools

All 3 →
6.0GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller · CVE-2026-118666Oct 288.2GraphQL Tools has prototype pollution in well-established utility function `mergeDeep` · CVE-2026-104852Oct 57.4GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor · CVE-2026-103921Oct 1