https://vulnerability.circl.lu/sightings/feed 2026-10-11T13:42:22.096992+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/48163025-3c00-45b7-9a06-350b6bc9b12e/export 2026-10-11T13:42:22.126937+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "48163025-3c00-45b7-9a06-350b6bc9b12e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-103921", "type": "seen", "source": "https://gist.github.com/alon710/996547278954ee07ee820c8e16cbac58", "content": "# CVE-2026-103921: CVE-2026-103921: TLS Certificate Validation Bypass in @graphql-tools/executor-legacy-ws\n\n> **CVSS Score:** 7.4\n> **Published:** 2026-10-05\n> **Full Report:** https://cvereports.com/reports/CVE-2026-103921\n\n## Summary\nA vulnerability in @graphql-tools/executor-legacy-ws prior to version 1.1.35 hardcodes the TLS rejectUnauthorized setting to false for outgoing secure WebSocket (wss://) connections. This defect allows unauthenticated remote attackers to perform Adversary-in-the-Middle (MitM) attacks, capturing or tampering with sensitive connection payloads and subscription data.\n\n## TL;DR\nThe @graphql-tools/executor-legacy-ws package failed to validate TLS certificates for outgoing wss:// connections, leaving Node.js applications vulnerable to credential theft and message manipulation via Adversary-in-the-Middle (MitM) attacks.\n\n## Technical Details\n\n- **CWE ID**: CWE-295 (Improper Certificate Validation)\n- **Attack Vector**: Network (Requires MitM positioning)\n- **CVSS v3.1 Score**: 7.4 (High Severity)\n- **EPSS Score**: 0.00268 (Percentile: 17.20%)\n- **Exploit Status**: No public functional exploit payload available\n- **CISA KEV Status**: Not listed\n- **Ransomware Association**: No known usage\n\n## Affected Systems\n\n- Node.js server applications implementing legacy GraphQL WebSocket subscriptions\n- GraphQL backend microservices utilizing @graphql-tools/url-loader\n- Server-side Javascript environments with outdated graphql-tools dependencies\n- **@graphql-tools/executor-legacy-ws**: < 1.1.35 (Fixed in: `1.1.35`)\n- **@graphql-tools/url-loader**: < 9.1.8 (Fixed in: `9.1.8`)\n\n## Mitigation\n\n- Upgrade @graphql-tools/executor-legacy-ws to version 1.1.35 or higher.\n- Upgrade transitive dependency @graphql-tools/url-loader to version 9.1.8 or higher.\n- Ensure rejectUnauthorized is not set to false in any production-facing configurations.\n- Isolate internal testing environments that require self-signed certificates from production pipelines.\n\n**Remediation Steps:**\n1. Identify all Node.js projects utilizing @graphql-tools/executor-legacy-ws or @graphql-tools/url-loader.\n2. Run 'npm install @graphql-tools/executor-legacy-ws@1.1.35' or update the package lockfile to ensure version alignment.\n3. Audit application instantiation files for explicit rejectUnauthorized overrides.\n4. Deploy the updated codebase and verify that connection attempts to invalid endpoints now throw TLS connection failures.\n\n## References\n\n- [GitHub Security Advisory GHSA-6fw5-9hq8-w87g](https://github.com/ardatan/graphql-tools/security/advisories/GHSA-6fw5-9hq8-w87g)\n- [Fix Commit 3831a0661514c91d99971052f983552556880402](https://github.com/ardatan/graphql-tools/commit/3831a0661514c91d99971052f983552556880402)\n- [@graphql-tools/executor-legacy-ws Release 1.1.35](https://github.com/ardatan/graphql-tools/releases/tag/@graphql-tools/executor-legacy-ws@1.1.35)\n- [NVD CVE-2026-103921 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-103921)\n- [CVE.org CVE-2026-103921 Record](https://www.cve.org/CVERecord?id=CVE-2026-103921)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-103921) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-05T23:30:32.000000Z"} 2026-10-05T23:30:32+00:00 https://vulnerability.circl.lu/sighting/ca12d5aa-d715-4dd7-9dbf-f501a919c9c9/export 2026-10-11T13:42:22.129362+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "ca12d5aa-d715-4dd7-9dbf-f501a919c9c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-103921", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/cjxliseurdyyw", "content": "CVE-2026-103921 - GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor\nCVE ID : CVE-2026-103921\n \n Published : Oct. 1, 2026, 4:32 p.m. | 28\u00a0minutes ago\n \n Description : GraphQL Tools provides utilities for building, stitching, and mocking Gra...", "creation_timestamp": "2026-10-01T18:04:48.413492Z"} 2026-10-01T18:04:48.413492+00:00