Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-103921— GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor

Quick assessment

Affected
ardatan graphql-tools
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

GraphQL Tools 提供了用于构建、拼接和模拟 GraphQL 模式的工具。在 1.1.35 版本之前， 中的 函数在 Node.js 连接到 端点时，硬编码禁用了 TLS 证书验证。因此，直接使用该执行器或使用 并指定 的应用程序，可能会接受由攻击者控制的证书，当处于网络中间位置的攻击者拦截连接时。这可能导致 或请求头中的认证信息泄露，并且订阅数据可能被篡改。浏览器端的 WebSocket 客户端不受此问题影响，因为浏览器会强制执行证书验证。该问题已在 1.1.35 版本中修复。

CVSS 7.4 · High EPSS 0.27% · P17

Possible ATT&CK Techniques 1 AI

T1557 · Adversary-in-the-Middle

Affected Version Matrix 2

VendorProduct Version RangeStatus
@graphql-tools executor-legacy-ws < 1.1.35 affected
ardatan graphql-tools < 1.1.35 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-103921

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor
Source: CVE Program / CVE List V5
Vulnerability Description
GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacyExecutor() function hardcodes TLS certificate rejection off for Node.js connections to wss:// endpoints. Applications using the executor directly, or url-loader with SubscriptionProtocol.LEGACY_WS, can therefore accept an attacker-controlled certificate when a network-positioned attacker intercepts the connection. Authentication material in connectionParams or headers can be disclosed, and subscription data can be modified. Browser WebSocket clients are unaffected because browsers enforce certificate validation. This issue is fixed in version 1.1.35.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
证书验证不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
ardatan graphql-tools < 1.1.35 -
@graphql-tools executor-legacy-ws < 1.1.35 -

II. Public POCs for CVE-2026-103921

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-103921

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-103921 (2)

Vendor Advisories for CVE-2026-103921 (1)

Vendor Pages for CVE-2026-103921 (1)

IV. Related Vulnerabilities

Same vendor: ardatan
Same weakness: CWE-295

V. Comments for CVE-2026-103921

No comments yet

Leave a comment