GraphQL Tools: Credential leak across requests in legacy WebSocket executor
Summary
A shared executor from the legacy WebSocket package @graphql-tools/executor-legacy-ws kept connection parameters from an earlier request. A later request that omits a sensitive key, such as an Authorization or tenant value, can send the earlier caller's value to the downstream server. The downstream server may then authenticate the later caller as the earlier user (CWE-613). Applications that create a new executor for every request are not affected.
Affected
- @graphql-tools/executor-legacy-ws before 1.1.36 (CNA-listed range)
- ardatan graphql-tools before 9.0.36 (CNA-listed range; verify against the vendor advisory, as older graphql-tools lines may have no fix)
Fixed in
- @graphql-tools/executor-legacy-ws 1.1.36 and later
- Fix released by the vendor in PR #8480 (commit c2f226e); the graphql-tools line to upgrade to must be confirmed in the vendor advisory GHSA-434m-5hcj-pxf3
Workaround
- Create a new executor for every request or every user, so no executor is shared between callers
- Turn off legacy WebSocket subscriptions if they are not needed
- No other vendor workaround is documented.
Exploitation
- Exploited in the wild: no evidence found.
- CISA KEV: not listed according to a third-party site; not yet verified against the CISA catalog.
- Public proof of concept: none found.
- EPSS: 0.39 % (percentile 33).
- Attack requires a network-reachable, authenticated user of the same application whose request reaches a shared executor.
Our recommendation
- Find all copies of graphql-tools and @graphql-tools/executor-legacy-ws in lockfiles, including transitive dependencies.
- Upgrade @graphql-tools/executor-legacy-ws to 1.1.36 or later and move graphql-tools to a fixed line per the vendor advisory.
- If an application cannot be upgraded, make sure it creates a new executor per request or per user.
- Check whether legacy WebSocket subscriptions are used and disable them if not.
- Monitor NVD, the CISA KEV catalog and the GitHub advisory for changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub commit c2f226e (fix for executor-legacy-ws) github.com
- GitHub pull request #8480 github.com
- GitHub release @graphql-tools/executor-legacy-ws@1.1.36 github.com
- GitHub security advisory GHSA-434m-5hcj-pxf3 github.com
- OSV entry GHSA-434m-5hcj-pxf3 osv.dev
- GitLab advisory for @graphql-tools/executor-legacy-ws advisories.gitlab.com
- VulDB entry CVE-2026-118665 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 14:43.
Original description (NVD)
GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts retains request.extensions.connectionParams in the closure-scoped executorConnectionParams object after cleanupWebsocket closes a connection. When one executor is reused across different authorization contexts, a later request that omits a sensitive key can send an earlier caller's Authorization or tenant value in its connection_init payload, causing the downstream server to authenticate the later caller as the earlier user. Applications that create a new executor for every request are not affected. This issue is fixed in version 1.1.36 of the GraphQL Tools legacy WebSocket executor package.
NVD references (4)
- https://github.com/ardatan/graphql-tools/commit/c2f226e6f68236be9e4a577f29faeaa92547458b
- https://github.com/ardatan/graphql-tools/pull/8480
- https://github.com/ardatan/graphql-tools/releases/tag/@graphql-tools/executor-legacy-ws@1.1.36
- https://github.com/ardatan/graphql-tools/security/advisories/GHSA-434m-5hcj-pxf3
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.