{"id":"EUVD-2026-112472","enisaUuid":"3c35ccb7-957e-3db9-9eb4-8b13298c26bc","description":"GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts retains request.extensions.connectionParams in the closure-scoped executorConnectionParams object after cleanupWebsocket closes a connection. When one executor is reused across different authorization contexts, a later request that omits a sensitive key can send an earlier caller\u0027s Authorization or tenant value in its connection_init payload, causing the downstream server to authenticate the later caller as the earlier user. Applications that create a new executor for every request are not affected. This issue is fixed in version 1.1.36 of the GraphQL Tools legacy WebSocket executor package.","datePublished":"Oct 28, 2026, 8:41:47 PM","dateUpdated":"Oct 28, 2026, 8:41:47 PM","baseScore":8.2,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/ardatan/graphql-tools/security/advisories/GHSA-434m-5hcj-pxf3\nhttps://github.com/ardatan/graphql-tools/pull/8480\nhttps://github.com/ardatan/graphql-tools/commit/c2f226e6f68236be9e4a577f29faeaa92547458b\nhttps://github.com/ardatan/graphql-tools/releases/tag/@graphql-tools/executor-legacy-ws@1.1.36\n","aliases":"CVE-2026-118665\nGHSA-434m-5hcj-pxf3\n","assigner":"GitHub_M","epss":0.39,"enisaIdProduct":[{"id":"65ef8877-32e1-36d7-9538-2f5ce8487025","product":{"name":"executor-legacy-ws","vendor":{"name":"@graphql-tools"}},"product_version":"\u003c 1.1.36"},{"id":"e8a04ade-83a5-3f40-9768-8ecc280889bf","product":{"name":"graphql-tools","vendor":{"name":"ardatan"}},"product_version":"\u003c 9.0.36"}],"enisaIdVendor":[{"id":"1c10f60d-e4c8-3749-afd7-27d5203f52ef","vendor":{"name":"ardatan"}},{"id":"e8d1fec2-1d97-39d6-9f5d-ca8d90a3a91c","vendor":{"name":"@graphql-tools"}}],"enisaIdVulnerability":[{"id":"4fb5679a-3bb7-3020-b87a-948b1b6b1d2e","vulnerability":{"id":"GHSA-434m-5hcj-pxf3","description":"GraphQL Tools: Per-request connection parameters persist into later users\u0027 WebSocket authentications","datePublished":"Oct 28, 2026, 9:05:17 PM","dateUpdated":"Oct 28, 2026, 9:05:17 PM","baseScore":0.0,"references":"https://github.com/ardatan/graphql-tools/security/advisories/GHSA-434m-5hcj-pxf3\nhttps://github.com/ardatan/graphql-tools/pull/8480\nhttps://github.com/ardatan/graphql-tools/commit/c2f226e6f68236be9e4a577f29faeaa92547458b\nhttps://github.com/ardatan/graphql-tools\nhttps://github.com/ardatan/graphql-tools/releases/tag/@graphql-tools/executor-legacy-ws@1.1.36\n","enisa_id":"EUVD-2026-112472\n","aliases":"CVE-2026-118665\nGHSA-434m-5hcj-pxf3\n","epss":0.0,"dataProcessed":"Oct 30, 2026, 11:02:20 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"dc14d8b0-4178-3a12-8c3d-1e254b6a9cd5","vulnerability":{"id":"CVE-2026-118665","description":"GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts retains request.extensions.connectionParams in the closure-scoped executorConnectionParams object after cleanupWebsocket closes a connection. When one executor is reused across different authorization contexts, a later request that omits a sensitive key can send an earlier caller\u0027s Authorization or tenant value in its connection_init payload, causing the downstream server to authenticate the later caller as the earlier user. Applications that create a new executor for every request are not affected. This issue is fixed in version 1.1.36 of the GraphQL Tools legacy WebSocket executor package.","datePublished":"Oct 28, 2026, 8:41:47 PM","dateUpdated":"Oct 28, 2026, 8:41:47 PM","status":"PUBLISHED","baseScore":8.2,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/ardatan/graphql-tools/security/advisories/GHSA-434m-5hcj-pxf3\nhttps://github.com/ardatan/graphql-tools/pull/8480\nhttps://github.com/ardatan/graphql-tools/commit/c2f226e6f68236be9e4a577f29faeaa92547458b\nhttps://github.com/ardatan/graphql-tools/releases/tag/@graphql-tools/executor-legacy-ws@1.1.36\n","enisa_id":"EUVD-2026-112472\n","assigner":"GitHub_M","epss":0.39,"dataProcessed":"Oct 30, 2026, 11:01:46 PM","vulnerabilityProduct":[{"id":"0d0b7caa-2c64-338d-aa2d-71bdede8b658","product":{"name":"executor-legacy-ws","vendor":{"name":"@graphql-tools"}},"product_version":"\u003c 1.1.36"},{"id":"3072b002-36e0-3209-96a6-a5a850b748e4","product":{"name":"graphql-tools","vendor":{"name":"ardatan"}},"product_version":"\u003c 9.0.36"}],"vulnerabilityVendor":[{"id":"2020f925-ce32-394e-b927-4d4c52498090","vendor":{"name":"@graphql-tools"}},{"id":"f4a03c85-d492-3ac7-bbcc-9aa60c4c27fd","vendor":{"name":"ardatan"}}]}}],"enisaIdAdvisory":[]}