CVE-2026-118665
Description
A flaw was found in GraphQL Tools legacy WebSocket executor. When an executor instance is reused across different authorization contexts, sensitive connection parameters such as authentication tokens are improperly retained after a connection closes. Consequently, a subsequent request lacking credentials can inherit an earlier caller's authorization data, allowing an unauthorized user to impersonate that user and access downstream services.
Statement
This vulnerability is rated as having Moderate impact for Red Hat products because exploitation requires specific design patterns where a legacy WebSocket executor is persistently shared across varying client authentication sessions. Under standard architectures or deployments that instantiate a fresh executor per incoming request, connection parameters remain isolated and credentials are not carried over. While unauthorized callers cannot directly extract stored tokens, unauthenticated queries might receive subscription data authorized under a preceding caller's permissions.
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Application Data
Data can "bleed" from one session to another through member variables of singleton objects, such as Servlets, and objects from a shared pool. Storing user data in Servlet member fields introduces a data access race condition.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
