CVE-2026-103921

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacyExecutor() function hardcodes TLS certificate rejection off for Node.js connections to wss:// endpoints. Applications using the executor directly, or url-loader with SubscriptionProtocol.LEGACY_WS, can therefore accept an attacker-controlled certificate when a network-positioned attacker intercepts the connection. Authentication material in connectionParams or headers can be disclosed, and subscription data can be modified. Browser WebSocket clients are unaffected because browsers enforce certificate validation. This issue is fixed in version 1.1.35.

CVSS v3 7.4 HIGH

7.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/ardatan/graphql-tools/commit/3831a0661514c91d99971052f983552556880402
https://github.com/ardatan/graphql-tools/pull/8426
https://github.com/ardatan/graphql-tools/releases/tag/@graphql-tools/executor-legacy-ws@1.1.35
https://github.com/ardatan/graphql-tools/security/advisories/GHSA-6fw5-9hq8-w87g

Configurations

No configuration.

History

01 Oct 2026, 17:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-01 17:17

Updated : 2026-10-02 18:44

NVD link : CVE-2026-103921

Mitre link : CVE-2026-103921

CVE.ORG link : CVE-2026-103921

JSON object : View

Products Affected

No product.

CWE

CWE-295

Improper Certificate Validation

{"id": "CVE-2026-103921", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-103921", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-10-01T18:04:13.318417Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "ardatan", "product": "graphql-tools", "versions": [{"status": "affected", "version": "< 1.1.35"}]}, {"vendor": "@graphql-tools", "product": "executor-legacy-ws", "versions": [{"status": "affected", "version": "< 1.1.35"}]}]}], "published": "2026-10-01T17:17:19.390", "references": [{"url": "https://github.com/ardatan/graphql-tools/commit/3831a0661514c91d99971052f983552556880402", "source": "security-advisories@github.com"}, {"url": "https://github.com/ardatan/graphql-tools/pull/8426", "source": "security-advisories@github.com"}, {"url": "https://github.com/ardatan/graphql-tools/releases/tag/@graphql-tools/executor-legacy-ws@1.1.35", "source": "security-advisories@github.com"}, {"url": "https://github.com/ardatan/graphql-tools/security/advisories/GHSA-6fw5-9hq8-w87g", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-295"}]}], "descriptions": [{"lang": "en", "value": "GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacyExecutor() function hardcodes TLS certificate rejection off for Node.js connections to wss:// endpoints. Applications using the executor directly, or url-loader with SubscriptionProtocol.LEGACY_WS, can therefore accept an attacker-controlled certificate when a network-positioned attacker intercepts the connection. Authentication material in connectionParams or headers can be disclosed, and subscription data can be modified. Browser WebSocket clients are unaffected because browsers enforce certificate validation. This issue is fixed in version 1.1.35."}], "lastModified": "2026-10-02T18:44:45.660", "sourceIdentifier": "security-advisories@github.com"}