CVE-2026-118666 | ardatan graphql-tools up to 1.1.35 legacy WebSocket executor index.ts buildWSLegacyExecutor improper authorization

October 28, 2026 Yanac

A vulnerability has been found in ardatan graphql-tools up to 1.1.35 and classified as problematic. This affects the function buildWSLegacyExecutor of the file packages/executors/legacy-ws/src/index.ts of the component legacy WebSocket executor. This manipulation causes improper authorization.

This vulnerability is handled as CVE-2026-118666. The attack can be initiated remotely. There is not any exploit available.

The affected component should be upgraded.VulDB Recent EntriesRead More