{"schema":"threatline.record/2","record":{"id":"CVE-2026-118665","aliases":["GHSA-434m-5hcj-pxf3"],"summary":"GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications","details":"GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts retains request.extensions.connectionParams in the closure-scoped executorConnectionParams object after cleanupWebsocket closes a connection. When one executor is reused across different authorization contexts, a later request that omits a sensitive key can send an earlier caller's Authorization or tenant value in its connection_init payload, causing the downstream server to authenticate the later caller as the earlier user. Applications that create a new executor for every request are not affected. This issue is fixed in version 1.1.36 of the GraphQL Tools legacy WebSocket executor package.","categories":["Unclassified"],"product":"graphql-tools","vendor":"ardatan","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-118665","source_modified_at":"2026-10-28T20:41:47.228Z","fetched_at":"2026-10-28T20:58:01.013507Z","product":"graphql-tools","vendor":"ardatan","versions":[{"version":"< 9.0.36","status":"affected"}],"defaultStatus":null},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-118665","source_modified_at":"2026-10-28T20:41:47.228Z","fetched_at":"2026-10-28T20:58:01.013507Z","product":"executor-legacy-ws","vendor":"@graphql-tools","versions":[{"version":"< 1.1.36","status":"affected"}],"defaultStatus":null}],"fixed_versions":[],"cvss":8.2,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-28T20:41:47.228Z","modified_at":"2026-10-28T20:41:47.228Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-118665","fetched_at":"2026-10-28T20:58:01.013507Z","source_modified_at":"2026-10-28T20:41:47.228Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/ardatan/graphql-tools/security/advisories/GHSA-434m-5hcj-pxf3","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/ardatan/graphql-tools/pull/8480","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/ardatan/graphql-tools/commit/c2f226e6f68236be9e4a577f29faeaa92547458b","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/ardatan/graphql-tools/releases/tag/@graphql-tools/executor-legacy-ws@1.1.36","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-28T20:41:47.228Z","content_hash":"1e8db531f5ba11e1eba9c4c4c6d10d1783fcfa6b6fcb8a7ca55b6b788da7aaa0"}}