CVE-2026-103921: GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor
GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacyExecutor() function hardcodes TLS certificate rejection off for Node.js connections to wss:// endpoints. Applications using the executor directly, or url-loader with SubscriptionProtocol.LEGACYWS, can therefore accept an attacker-controlled certificate when a network-positioned attacker intercepts the connection. Authentication material in connectionParams or headers can be disclosed, and subscription data can be modified. Browser WebSocket clients are unaffected because browsers enforce certificate validation. This issue is fixed in version 1.1.35.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GraphQL Toolsto a version that resolves this vulnerability.Fixed in 1.1.35
Event History
Frequently Asked Questions
Which deployments are exposed?
Node.js applications that use buildWSLegacyExecutor() directly or use url-loader with SubscriptionProtocol.LEGACY_WS to connect to wss:// endpoints are exposed before version 1.1.35. Browser-based WebSocket clients are unaffected because browsers enforce certificate validation.
What does an attacker need to exploit this?
An attacker must be in a network position to intercept the application's wss:// connection and present an attacker-controlled TLS certificate. No authentication or user interaction is required.
What is at risk if exploitation succeeds?
Authentication material supplied through connectionParams or headers can be disclosed. An attacker can also modify subscription data transmitted over the intercepted connection.
What should teams do if they cannot patch immediately?
The provided data identifies the affected legacy executor and protocol mode, but does not specify a workaround. Prioritize removing or avoiding executor-legacy-ws and SubscriptionProtocol.LEGACY_WS usage for Node.js wss:// connections until upgrading to version 1.1.35 or later.