CVE-2026-103921

HIGH 7.4

GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor

CVSS Score

7.4

EPSS Score

0.0%

EPSS Percentile

0th

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacyExecutor() function hardcodes TLS certificate rejection off for Node.js connections to wss:// endpoints. Applications using the executor directly, or url-loader with SubscriptionProtocol.LEGACY_WS, can therefore accept an attacker-controlled certificate when a network-positioned attacker intercepts the connection. Authentication material in connectionParams or headers can be disclosed, and subscription data can be modified. Browser WebSocket clients are unaffected because browsers enforce certificate validation. This issue is fixed in version 1.1.35.

CWE	CWE-295
Vendor	ardatan
Product	graphql-tools
Published	Oct 1, 2026

Stay Ahead of the Next One

Get instant alerts for ardatan graphql-tools

Be the first to know when new high vulnerabilities affecting ardatan graphql-tools are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Affected Versions

ardatan / graphql-tools

< 1.1.35

@graphql-tools / executor-legacy-ws

< 1.1.35

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/ardatan/graphql-tools/security/advisories/GHSA-6fw5-9hq8-w87g github.com: https://github.com/ardatan/graphql-tools/pull/8426 github.com: https://github.com/ardatan/graphql-tools/commit/3831a0661514c91d99971052f983552556880402 github.com: https://github.com/ardatan/graphql-tools/releases/tag/@graphql-tools/[email protected]