Vulnerability · Published Oct 28, 2026 · Assigned by GitHub_M

CVE-2026-118665GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications

High 8.2

In plain English

A high-severity security flaw in graphql-tools from ardatan. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.2High

Exploit odds (30 days)0.4%top 66.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts retains request.extensions.connectionParams in the closure-scoped executorConnectionParams object after cleanupWebsocket closes a connection. When one executor is reused across different authorization contexts, a later request that omits a sensitive key can send an earlier caller's Authorization or tenant value in its connection_init payload, causing the downstream server to authenticate the later caller as the earlier user. Applications that create a new executor for every request are not affected. This issue is fixed in version 1.1.36 of the GraphQL Tools legacy WebSocket executor package.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	@graphql-tools/executor-legacy-ws	1.1.36	GHSA-434m-5hcj-pxf3

Affected products (as reported)

Vendor	Product	Versions
ardatan	graphql-tools	< 9.0.36
@graphql-tools	executor-legacy-ws	< 1.1.36

Weakness: CWE-613 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://github.com/ardatan/graphql-tools/security/advisories/GHSA-434m-5hcj-pxf3 x_refsource_CONFIRM
https://github.com/ardatan/graphql-tools/pull/8480 x_refsource_MISC
https://github.com/ardatan/graphql-tools/commit/c2f226e6f68236be9e4a577f29faeaa92547458b x_refsource_MISC
https://github.com/ardatan/graphql-tools/releases/tag/@graphql-tools/executor-legacy-ws@1.1.36 x_refsource_MISC