GraphQL Tools Legacy WebSocket Executor Vulnerability in Ardatan Product
CVE-2026-118665

8.2HIGH

Key Information:

Vendor

Ardatan

Status
Graphql-tools
Executor-legacy-ws
Vendor
CVE Published:
28 October 2026

What is CVE-2026-118665?

The GraphQL Tools legacy WebSocket executor package contains an improper authentication vulnerability due to the retention of sensitive connection parameters after a WebSocket connection is closed. When the buildWSLegacyExecutor function processes requests, it incorrectly preserves request.extensions.connectionParams, leading to potential misidentification of user credentials across different authorization contexts. This can occur if an executor is reused between requests, allowing a user’s Authorization or tenant values to unintentionally transfer to another caller, compromising data integrity and confidentiality. This vulnerability is resolved in version 1.1.36 of the package.

Affected Version(s)

executor-legacy-ws < 1.1.36

graphql-tools < 9.0.36

References

https://github.com/ardatan/graphql-tools/security/advisor...
x_refsource_CONFIRM
https://github.com/ardatan/graphql-tools/pull/8480
x_refsource_MISC
https://github.com/ardatan/graphql-tools/commit/c2f226e6f...
x_refsource_MISC

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.