CVE-2026-118665 in GraphQL Tools
Summary
by MITRE • 10/28/2026
GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts retains request.extensions.connectionParams in the closure-scoped executorConnectionParams object after cleanupWebsocket closes a connection. When one executor is reused across different authorization contexts, a later request that omits a sensitive key can send an earlier caller's Authorization or tenant value in its connection_init payload, causing the downstream server to authenticate the later caller as the earlier user. Applications that create a new executor for every request are not affected. This issue is fixed in version 1.1.36 of the GraphQL Tools legacy WebSocket executor package.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified within the GraphQL Tools library, specifically affecting versions prior to 1.1.36 of its legacy WebSocket executor package, represents a critical authentication bypass risk rooted in improper state management during connection lifecycle events. The core technical flaw resides in the buildWSLegacyExecutor function located at packages/executors/legacy-ws/src/index.ts. This utility is designed to facilitate communication between GraphQL clients and servers over WebSockets by managing persistent connections that allow for real-time data exchange via subscriptions. Under normal operational conditions, when a WebSocket connection is terminated or closed, the cleanupWebsocket routine is invoked to release resources and reset internal state variables associated with that specific session. However, in affected versions, this cleanup process fails to clear the executorConnectionParams object, which is scoped within the closure of the executor function. Consequently, sensitive authentication metadata such as authorization tokens, tenant identifiers, or other connection parameters persist in memory even after the logical end of a user's session.
This persistence of state creates a severe security implication when the application architecture reuses WebSocket executors across multiple distinct users or authorization contexts rather than instantiating a new executor for each individual request. In such scenarios, if an attacker initiates a connection with valid credentials and subsequently closes it without fully disconnecting from the underlying socket pool, their authentication parameters remain stored in the shared closure scope. When another user establishes a subsequent WebSocket connection that is assigned to this same reused executor instance, the system may inadvertently attach the residual connection_init payload containing the previous user's sensitive data. This results in the downstream GraphQL server authenticating and authorizing the new request under the identity of the prior caller, effectively bypassing access controls and allowing unauthorized access to protected resources or private tenant data.
The operational impact of this vulnerability is significant for applications relying on shared connection pools for performance optimization. An attacker can exploit this flaw to perform account takeover attacks by leveraging residual authentication context from other users. This leads to a complete compromise of confidentiality, as sensitive business logic and personal identifiable information become accessible to unauthorized entities. Furthermore, it undermines the integrity of audit logs since actions performed under an impersonated identity are attributed incorrectly. The severity is exacerbated in multi-tenant SaaS environments where tenant isolation is paramount; leaking one tenant's connection parameters could allow access to another tenant's data if the backend logic relies on these headers for routing or filtering queries.
To mitigate this risk, organizations must immediately upgrade the GraphQL Tools legacy WebSocket executor package to version 1.1.36 or later, which implements proper cleanup procedures that clear the executorConnectionParams object upon connection closure. For applications unable to update immediately due to dependency constraints, a temporary workaround involves configuring the application to create a new executor instance for every single request rather than reusing existing connections across different users. While this approach may introduce performance overhead due to increased connection establishment latency, it ensures strict isolation of authentication contexts and eliminates the possibility of state leakage between sessions. Additionally, developers should review their WebSocket implementation strategies to ensure that any custom executors adhere to secure coding practices regarding session termination and variable scoping.
From a classification perspective, this vulnerability aligns with CWE-613, which describes Insufficient Session Expiration, as it involves the retention of sensitive state information beyond its intended lifespan. It also maps directly to MITRE ATT&CK technique T1078, specifically Valid Accounts, where an attacker uses legitimate credentials obtained from another user or system context to gain unauthorized access. The failure to properly invalidate session-specific data during teardown is a classic example of improper resource cleanup leading to privilege escalation through identity confusion. Ensuring that all stateful components in GraphQL infrastructure are correctly reset upon disconnection is essential for maintaining robust authentication hygiene and preventing cross-user contamination of security contexts.