Log in Start free

Vulnerability · Published Oct 28, 2026 · Assigned by GitHub_M

CVE-2026-118666GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller

Medium 6.0

In plain English

A medium-severity information exposure in graphql-tools from ardatan. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.0Medium
Exploit odds (30 days)0.3%top 73.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts reuses one WebSocket and replaces its single websocket.onmessage handler whenever a new overlapping subscription starts. The handler delivers LEGACY_WS.DATA frames to the newest observer without comparing data.id with the subscription operation id, so a caller using the same executor can receive another user's authorized subscription payload while the earlier caller's stream is starved. This issue is fixed in version 1.1.36 of the GraphQL Tools legacy WebSocket executor package.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npm@graphql-tools/executor-legacy-ws1.1.36GHSA-mp66-8ww2-pcwm

Affected products (as reported)

VendorProductVersions
ardatan graphql-tools < 9.0.36
@graphql-tools executor-legacy-ws < 1.1.36

Weakness: CWE-200 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

References