CVE-2026-118666

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts reuses one WebSocket and replaces its single websocket.onmessage handler whenever a new overlapping subscription starts. The handler delivers LEGACY_WS.DATA frames to the newest observer without comparing data.id with the subscription operation id, so a caller using the same executor can receive another user's authorized subscription payload while the earlier caller's stream is starved. This issue is fixed in version 1.1.36 of the GraphQL Tools legacy WebSocket executor package.

• CWE-200

• https://github.com/ardatan/graphql-tools/commit/c2f226e6f68236be9e4a577f29faeaa92547458b
• https://github.com/ardatan/graphql-tools/pull/8480
• https://github.com/ardatan/graphql-tools/releases/tag/@graphql-tools/executor-legacy-ws@1.1.36
• https://github.com/ardatan/graphql-tools/security/advisories/GHSA-mp66-8ww2-pcwm

Published

Oct 28, 2026

Last Modified

Oct 29, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-118660Happy DOM is a JavaScript implementation of a web browser wi…8.6
• CVE-2026-118661Happy DOM is a JavaScript implementation of a web browser wi…6.5
• CVE-2026-118662Vite is a frontend tooling framework for JavaScript. From 6.…6.9
• CVE-2026-118663@hono/node-server allows running the Hono application on Nod…5.3
• CVE-2026-118664decode-uri-component provides a more robust alternative to d…8.2
• CVE-2026-118665GraphQL Tools provides utilities for building, stitching, an…8.2
• CVE-2026-118667LangGraph Python SDK is used to connect to running LangGraph…4.3
• CVE-2026-118668langgraph-api implements the LangGraph API for rapid develop…8.6
• CVE-2026-118669OAuthLib is an implementation of the OAuth request-signing l…8.4
• CVE-2026-11867The Frontend Admin by DynamiApps WordPress plugin before 3.2…6.5
• CVE-2026-118673KeePassXC is a cross-platform community-driven port of the W…4.1
• CVE-2026-118675n8n before 1.123.85, 2.43.5, and 2.44.1 contains a credentia…7.1