GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-295.
Summary
GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacyExecutor() function hardcodes TLS certificate rejection off for Node.js connections to wss:// endpoints. Applications using the executor directly, or url-loader with SubscriptionProtocol.LEGACY_WS, can therefore accept an attacker-controlled certificate when a network-positioned attacker intercepts the connection. Authentication material in connectionParams or headers can be disclosed, and subscription data can be modified. Browser WebSocket clients are unaffected because browsers enforce certificate validation. This issue is fixed in version 1.1.35.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ardatan | graphql-tools | before 1.1.35 | 1.1.35 | Patch available | CNA |
| @graphql-tools | executor-legacy-ws | before 1.1.35 | 1.1.35 | Patch available | CNA |
| — | @graphql-tools/executor-legacy-ws (npm) | before 1.1.35 | 1.1.35 | Patch available | GHSA-6fw5-9hq8-w87g |
- graphql-tools Vendorardatan Affected before 1.1.35 Fixed in 1.1.35 Patch available CNA
- executor-legacy-ws Vendor@graphql-tools Affected before 1.1.35 Fixed in 1.1.35 Patch available CNA
- @graphql-tools/executor-legacy-ws (npm) Vendor— Affected before 1.1.35 Fixed in 1.1.35 Patch available GHSA-6fw5-9hq8-w87g
Remediation
- Fix · CNA graphql-tools (ardatan) Fixed in 1.1.35
- Fix · CNA executor-legacy-ws (@graphql-tools) Fixed in 1.1.35
- Fix · GHSA-6fw5-9hq8-w87g @graphql-tools/executor-legacy-ws (npm) Fixed in 1.1.35 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-103921
- 2026-10-06 Alias added: GHSA-6fw5-9hq8-w87g
- 2026-10-06 Fix available: npm/@graphql-tools/[email protected] · GHSA-6fw5-9hq8-w87g
- 2026-10-06 CVSS score added · GHSA-6fw5-9hq8-w87g
- 2026-10-06 Weakness changed · GHSA-6fw5-9hq8-w87g
- 2026-10-06 6 new references · GHSA-6fw5-9hq8-w87g
References
Other 5
- https://github.com/ardatan/graphql-tools/security/advisories/GHSA-6fw5-9hq8-w87g
- https://github.com/ardatan/graphql-tools/pull/8426
- https://github.com/ardatan/graphql-tools/commit/3831a0661514c91d99971052f983552556880402
- https://github.com/ardatan/graphql-tools/releases/tag/@graphql-tools/[email protected]
- https://github.com/ardatan/graphql-tools
More ardatan vulnerabilities
- TI-2026-82206 Stale connection parameters in GraphQL Tools WebSocket executor CVSS 4.0HIGH 8.2
- TI-2026-82207 GraphQL Tools legacy WebSocket executor misroutes subscription data CVSS 4.0MEDIUM 6.0
- TI-2026-85665 Prototype pollution in GraphQL Tools mergeIncrementalResult helper CVSS 4.0HIGH 8.4
- TI-2026-68299 Prototype pollution in GraphQL Tools mergeDeep function CVSS 4.0HIGH 8.2
Sources
- CVE-2026-103921 · CVE Program
- CVE-2026-103921 · NVD
- FIRST EPSS
- GHSA-6fw5-9hq8-w87g · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences