GraphQL Tools CVE-2026-118665

Exploitation requires all of the following, drawn from the advisory: (1) one executor instance from buildWSLegacyExecutor is reused across requests belonging to different users/authorization contexts (the gateway, schema-stitching, or GraphQL Mesh sharing pattern); (2) the application uses the documented request.extensions.connectionParams field to carry per-request downstream identity such as an Authorization bearer token or tenant value; (3) the prior operation's socket has been closed before the attacker's request opens a new one - the normal path, since the COMPLETE handler calls cleanupWebsocket() after every operation; and (4) the attacker's later request omits at least one sensitive key (Object.assign merges rather than replaces, so a partial request can inherit the victim's retained Authorization while supplying its own tenant). Limiting factors: applications that construct a fresh executor per request - including the in-repository UrlLoader wrapper - are not affected; no supported teardown (including executor[Symbol.dispose]()) clears the retained state; and the attacker does not learn the credential itself, only inherits the downstream authorization it grants.

Severity signals are moderately high but strongly gated by an architectural precondition. The only provided CVSS is a vendor CVSS 4.0 base vector (8.2) with AV:N/AC:H/AT:P/PR:N/UI:N and confidentiality-only impact (VC:H/VI:N/VA:N) - network-reachable and requiring no attacker privileges, but with high attack complexity and an explicit attack requirement (AT:P) reflecting that exploitation depends on a specific, attacker-uncontrolled sequence of events in a shared-executor deployment. No CVSS 3.1 vector, no EPSS score, and no KEV listing are present in the input, so widespread-exploitation probability cannot be quantified from the data. The vuln.today decision label is 'this_week' (not act_now/emergency), a patch is available, and the GitHub Security Advisory documents a validated reproduction. Net assessment: this is a genuine broken-authentication/stale-credential issue (CWE-613) worth prioritized remediation within the vendor-indicated window, but it is not a drive-by remote code execution - real-world risk is concentrated in applications that reuse one buildWSLegacyExecutor instance across different authorization contexts (gateway, schema-stitching, or mesh patterns using extensions.connectionParams). Applications that build a fresh executor per request are explicitly not affected, so the high base score overstates risk for the common per-request-executor usage.

In a shared GraphQL gateway that reuses one legacy WebSocket executor across users and forwards per-request credentials via extensions.connectionParams, an authenticated victim first runs a subscription that sets an Authorization/tenant value into the executor's closure state. After that socket closes, an attacker sends an anonymous request (or one omitting the auth key) through the same gateway; the executor replays the victim's retained connectionParams in the new connection_init, so the downstream server authenticates the attacker as the victim and returns data the attacker should not see. The vendor's published advisory includes a validated reproduction confirming the leak on releases up to 1.1.35.