Executor Legacy Ws
Monthly
TLS certificate validation is disabled by default in @graphql-tools/executor-legacy-ws prior to 1.1.35, where buildWSLegacyExecutor() hardcoded rejectUnauthorized: false, so Node.js applications using that executor directly or url-loader configured with SubscriptionProtocol.LEGACY_WS will blindly accept any certificate presented over wss://. An unauthenticated attacker who already holds a man-in-the-middle position on the network path can impersonate the GraphQL subscription endpoint, disclose authentication material carried in connectionParams or headers, and modify subscription data; the assessed CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, with the MITM prerequisite driving the High attack complexity. No public exploit code and no CISA KEV entry were identified at time of analysis, and browser WebSocket clients are unaffected because browsers independently enforce certificate validation.
TLS certificate validation is disabled by default in @graphql-tools/executor-legacy-ws prior to 1.1.35, where buildWSLegacyExecutor() hardcoded rejectUnauthorized: false, so Node.js applications using that executor directly or url-loader configured with SubscriptionProtocol.LEGACY_WS will blindly accept any certificate presented over wss://. An unauthenticated attacker who already holds a man-in-the-middle position on the network path can impersonate the GraphQL subscription endpoint, disclose authentication material carried in connectionParams or headers, and modify subscription data; the assessed CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, with the MITM prerequisite driving the High attack complexity. No public exploit code and no CISA KEV entry were identified at time of analysis, and browser WebSocket clients are unaffected because browsers independently enforce certificate validation.