CVE-2026-118666Published
GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-118666 · Microsoft / collected KEV context
cve-program · CVE-2026-118666
- https://github.com/ardatan/graphql-tools/security/advisories/GHSA-mp66-8ww2-pcwm
- https://github.com/ardatan/graphql-tools/pull/8480
- https://github.com/ardatan/graphql-tools/commit/c2f226e6f68236be9e4a577f29faeaa92547458b
- https://github.com/ardatan/graphql-tools/releases/tag/@graphql-tools/[email protected]
euvd · EUVD-2026-112473
- https://github.com/ardatan/graphql-tools/security/advisories/GHSA-mp66-8ww2-pcwm
- https://github.com/ardatan/graphql-tools/pull/8480
- https://github.com/ardatan/graphql-tools/commit/c2f226e6f68236be9e4a577f29faeaa92547458b
- https://github.com/ardatan/graphql-tools/releases/tag/@graphql-tools/[email protected]
nvd · CVE-2026-118666
- https://github.com/ardatan/graphql-tools/commit/c2f226e6f68236be9e4a577f29faeaa92547458b
- https://github.com/ardatan/graphql-tools/pull/8480
- https://github.com/ardatan/graphql-tools/releases/tag/@graphql-tools/[email protected]
- https://github.com/ardatan/graphql-tools/security/advisories/GHSA-mp66-8ww2-pcwm
osv · GHSA-mp66-8ww2-pcwm
- https://github.com/ardatan/graphql-tools/security/advisories/GHSA-mp66-8ww2-pcwm
- https://github.com/ardatan/graphql-tools/pull/8480
- https://github.com/ardatan/graphql-tools/commit/c2f226e6f68236be9e4a577f29faeaa92547458b
- https://github.com/ardatan/graphql-tools
- https://github.com/ardatan/graphql-tools/releases/tag/@graphql-tools/[email protected]
Related operational evidence
Explicit CVE identifiers- GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts reuses… · Advisory content revised · 30 Oct 2026
- GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts reuses… · Advisory content revised · 30 Oct 2026
- GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller · Newly collected advisory · 28 Oct 2026
- GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller · Newly collected advisory · 28 Oct 2026