CVE-2026-103921 in graphql-tools
Summary
by MITRE • 10/01/2026
GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacyExecutor() function hardcodes TLS certificate rejection off for Node.js connections to wss:// endpoints. Applications using the executor directly, or url-loader with SubscriptionProtocol.LEGACY_WS, can therefore accept an attacker-controlled certificate when a network-positioned attacker intercepts the connection. Authentication material in connectionParams or headers can be disclosed, and subscription data can be modified. Browser WebSocket clients are unaffected because browsers enforce certificate validation. This issue is fixed in version 1.1.35.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/01/2026
The vulnerability identified within GraphQL Tools prior to version 1.1.35 represents a critical misconfiguration in the handling of secure transport layer connections for server-side WebSocket implementations. Specifically, the executor-legacy-ws module contains a function named buildWSLegacyExecutor which is responsible for establishing legacy WebSocket connections over WebSockets Secure (wss://) protocols. In versions preceding 1.1.35, this function explicitly disables TLS certificate validation when initializing Node.js client connections to remote endpoints. This hardcoded behavior effectively bypasses the standard cryptographic mechanisms designed to verify the identity of the server being connected to, leaving the communication channel vulnerable to interception and manipulation by malicious actors who can position themselves within the network path between the application and the GraphQL subscription endpoint.
From a technical perspective, this flaw constitutes an improper certificate validation error where the client fails to ensure that the presented X.509 certificate is signed by a trusted Certificate Authority or matches expected criteria. By disabling these checks, the application creates a blind trust relationship with any server presenting itself at the target URL, regardless of whether the identity has been cryptographically verified. This allows for classic man-in-the-middle attacks where an adversary can intercept the WebSocket handshake and subsequent data streams without triggering security warnings or connection failures within the Node.js runtime environment. The issue is specific to server-side execution contexts using the legacy WebSocket protocol; browser-based clients remain unaffected because modern web browsers enforce strict TLS certificate validation as part of their core networking stack, thereby preventing such bypasses in client-side applications.
The operational impact of this vulnerability is severe due to the nature of GraphQL subscriptions and authentication mechanisms often passed during connection initialization. When a network-positioned attacker successfully intercepts the connection using tools like SSLStrip or similar MITM frameworks, they can perform active session hijacking or data exfiltration. Authentication materials such as API keys, JWT tokens, or other credentials transmitted within the connectionParams object or HTTP headers are exposed in plaintext to the interceptor. Furthermore, because GraphQL subscriptions often involve real-time data feeds, an attacker with this level of access can not only read sensitive information but also modify subscription payloads injected into the stream. This compromises both confidentiality and integrity, potentially leading to unauthorized data disclosure, account takeover if credentials are reused elsewhere, or injection of malicious logic that affects downstream consumers of the compromised data feed.
This vulnerability aligns closely with Common Weakness Enumeration (CWE) identifiers such as CWE-295 Improper Certificate Validation and CWE-319 Cleartext Transmission of Sensitive Information within an ATT&CK framework context, it facilitates techniques associated with Intercepting Communication Traffic to harvest credentials or manipulate data flows. To mitigate this risk, organizations must upgrade GraphQL Tools to version 1.1.35 or later where the default behavior correctly enforces TLS certificate validation for all WebSocket connections initiated by Node.js clients. Additionally, developers should implement defense-in-depth strategies including strict transport security policies and regular audits of third-party library configurations to ensure that cryptographic defaults have not been inadvertently weakened in production environments.