CVE-2026-118666: GraphQL Tools legacy WebSocket executor data and auth isolation flaw

CVE-2026-118666 · Severity: medium · CVSS 4 · Published 2026-10-28

GraphQL Tools provides utilities for building and managing GraphQL schemas, including a legacy WebSocket executor used for real-time subscriptions. A flaw in this executor allows multiple concurrent callers sharing the same executor to leak authorized subscription data between them—one user's subscription payload can be delivered to another user's request, and authentication credentials can be reused across callers. This could lead to unauthorized access to sensitive real-time data.

Technologies: @graphql-tools/executor-legacy-ws (npm). Vendors: npm.

Quick answers

Is CVE-2026-118666 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-118666 being exploited in the wild.
How severe is CVE-2026-118666?
Medium severity, with a CVSS score of 4, published 28 October 2026.
Which products and versions are affected?
GraphQL Tools Executor-Legacy-Ws before 1.1.36; @graphql-tools/executor-legacy-ws (npm) <= 1.1.35, SEMVER:introduced=0,fixed=1.1.36.
Is there a fix for CVE-2026-118666?
Yes. @graphql-tools/executor-legacy-ws (npm): upgrade to 1.1.36 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-118666 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-118666?
Check whether you run GraphQL Tools Executor-Legacy-Ws or @graphql-tools/executor-legacy-ws (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @graphql-tools/executor-legacy-ws (npm): upgrade to 1.1.36 or later
    npm install @graphql-tools/executor-legacy-ws@1.1.36

Technical details

The buildWSLegacyExecutor in the legacy WebSocket package reused a single WebSocket connection and a single onmessage handler across multiple callers, failing to validate operation IDs on incoming data frames and retaining connection parameters across executions. An attacker or privileged caller can receive another subscriber's LEGACY_WS.DATA frames without matching the subscription operation ID, and later executions can inherit previous callers' authentication connection parameters (CWE-200, CWE-613). The vulnerability requires multiple concurrent subscriptions using the same executor instance.

Affected products

  • graphql-tools executor-legacy-ws before 1.1.36

Identifiers

  • CVE-2026-118666
  • GHSA-mp66-8ww2-pcwm

Timeline

  • 2026-10-28: advisory
  • 2026-10-01: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.