CVE-2026-103921
Received Received - Intake

GraphQL Tools TLS Certificate Validation Bypass

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: GitHub, Inc.

Description
GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacyExecutor() function hardcodes TLS certificate rejection off for Node.js connections to wss:// endpoints. Applications using the executor directly, or url-loader with SubscriptionProtocol.LEGACY_WS, can therefore accept an attacker-controlled certificate when a network-positioned attacker intercepts the connection. Authentication material in connectionParams or headers can be disclosed, and subscription data can be modified. Browser WebSocket clients are unaffected because browsers enforce certificate validation. This issue is fixed in version 1.1.35.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-01
Last Modified
2026-10-01
Generated
2026-10-01
AI Q&A
2026-10-01
EPSS Evaluated
N/A
NVD
CVE-2026-103921
EUVD
EUVD-2026-90922

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
graphql_tools graphql_tools 1.1.35
ardatan graphql-tools to 1.1.35 (exc)
ardatan executor-legacy-ws to 1.1.35 (exc)
ardatan url-loader to 9.1.9 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-295 The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects GraphQL Tools versions before 1.1.35. The legacy WebSocket executor function hardcoded TLS certificate rejection to off for Node.js connections to wss:// endpoints. This allowed attackers to intercept connections and bypass certificate validation, potentially exposing authentication data or modifying subscription content.

Detection Guidance

To detect this vulnerability, check if your system uses GraphQL Tools versions 1.1.34 or earlier. Inspect WebSocket connections for hardcoded TLS certificate rejection settings. Use commands like 'npm list @graphql-tools/executor-legacy-ws' or 'yarn list @graphql-tools/executor-legacy-ws' to verify installed versions.

Impact Analysis

If you use affected GraphQL Tools versions with Node.js WebSocket connections, an attacker could intercept your connection to a wss:// endpoint. This may expose credentials sent via headers or connectionParams and allow tampering with subscription data. Browser clients are unaffected as they enforce certificate validation.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data transmitted over WebSocket connections, potentially violating GDPR (data protection) and HIPAA (health data privacy) requirements. Unauthorized interception or modification of data undermines confidentiality and integrity controls required by these regulations.

Mitigation Strategies

Upgrade to GraphQL Tools version 1.1.35 or later. Ensure TLS certificate validation is enabled by default. Avoid sending sensitive credentials over legacy WebSocket connections. Use modern protocols like graphql-ws or SubscriptionProtocol.WS if possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103921. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart