CVE-2026-118666
Description
A flaw was found in the GraphQL Tools legacy WebSocket executor. When handling concurrent subscriptions, the executor reuses a single WebSocket connection and replaces the active message handler without validating incoming subscription operation identifiers. A user sharing the executor can exploit this vulnerability by initiating an overlapping subscription, leading to information disclosure through intercepting another user's subscription payload while starving the earlier subscriber's data stream.
Statement
This vulnerability is rated as Moderate severity because, while an unauthorized party could intercept another subscriber's private data stream, successful exploitation requires concurrent overlapping subscriptions on an executor instance shared across multiple client contexts. Applications that create dedicated executor instances per client request or use modern GraphQL WebSocket transport protocols instead of the legacy executor package are not vulnerable to this cross-tenant data routing defect. Under typical Red Hat environments, the legacy WebSocket executor is not deployed or utilized by default.
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Application Data
Data can "bleed" from one session to another through member variables of singleton objects, such as Servlets, and objects from a shared pool. Storing user data in Servlet member fields introduces a data access race condition.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
