WebSocket Overlap Vulnerability in GraphQL Tools Legacy Executor by Ardatan

CVE-2026-118666

What is CVE-2026-118666?

The GraphQL Tools legacy WebSocket executor is affected by a significant issue where it reuses a single WebSocket connection. This design flaw allows multiple overlapping subscriptions to interfere with each other. Specifically, when a new subscription begins, it replaces the onmessage handler for the WebSocket without verifying the subscription operation IDs. As a result, a user may inadvertently receive data intended for another user’s subscription, leading to unauthorized access to sensitive information. This vulnerability has been addressed in version 1.1.36, which implements a more secure method of managing WebSocket connections to protect user data and preserve subscription integrity.

References