8.2

CVE-2026-118665: GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications

Awaiting analysis
AliasesGHSA-434m-5hcj-pxf3CGA-pp4v-4vhq-6x8mCGA-3qm8-qqjf-2mwp
Published 28-10-2026Last modified 03-11-2026

Vulnerability summary

CVE-2026-118665 is a high (CVSS 8.2) vulnerability in ardatan graphql-tools. EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 32.9% of scored vulnerabilities.

Priority
Prioritisesevere

Severe, CVSS 8.2 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 0% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?
CVSS score
8.2/10
010
High · v4.0 (CVE.org)
EPSS score
0.39%
0%100%
Low · Change unavailable
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Timeline

  1. 28-10-2026
    PublishedVulnerability first disclosed.
  2. 03-11-2026
    Last modifiedVulnerability information updated.

Description

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts retains request.extensions.connectionParams in the closure-scoped executorConnectionParams object after cleanupWebsocket closes a connection. When one executor is reused across different authorization contexts, a later request that omits a sensitive key can send an earlier caller's Authorization or tenant value in its connection_init payload, causing the downstream server to authenticate the later caller as the earlier user. Applications that create a new executor for every request are not affected. This issue is fixed in version 1.1.36 of the GraphQL Tools legacy WebSocket executor package.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.39%

Chance of exploitation in the next 30 days

Percentile

33%

Versus all other CVEs

30-day change

Change unavailable

Change unavailable

29-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard7 products
  • gitlab-rails-ce-18.10All versions (No fix recorded)
  • gitlab-rails-ce-18.8All versions (No fix recorded)
  • gitlab-rails-ce-18.9All versions (No fix recorded)
  • gitlab-rails-ce-19.2All versions (No fix recorded)
  • gitlab-rails-ce-19.4All versions (No fix recorded) | < 19.4.3-r8
@graphql-tools2 products
Ardatan1 product

3 vendors · 10 products

References

7 links