CVE-2026-45739lowCWE-200CWE-201

CVE-2026-45739: low-severity vulnerability in strawberry-graphql strawberry

Strawberry GraphQL: Default GraphiQL may expose HTTP headers in URLs

Published

Follow this CVE+ Monitor strawberry+ Monitor strawberry-graphql

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 3.1epss 0.2%
Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.288.4 through 0.315.3, Strawberry's bundled GraphiQL template wrote values from the GraphiQL headers editor into the browser URL query string. If a user entered a sensitive header, such as `Authorization: Bearer <token>`, the value could become visible in browser history, copied links, and server/proxy/CDN access logs after a page reload or shared request. Version 0.315.4 patches the issue.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Affected products
strawberry-graphql · strawberry
Related CVEs — strawberry-graphql strawberry

In the same product, most dangerous first.

CVE-2026-47707MEDIUMStrawberry GraphQL's Bypass of MaxAliasesLimiter via Fragment Spreads leading to GraphQL Alias AmplificationEPSS 0.5%CVE-2026-107728HIGHStrawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthyEPSS 0.4%CVE-2026-107727LOWStrawberry legacy graphql-ws retains naturally completed subscription slotsEPSS 0.4%CVE-2026-35523HIGHAuthentication bypass in strawberry-graphql via legacy graphql-ws WebSocket subprotocolEPSS 0.4%CVE-2025-22151LOWStrawberry GraphQL has a type resolution vulnerabilityEPSS 0.4%CVE-2026-47706MEDIUMStrawberry GraphQL has a Circular Fragment Reference DOSEPSS 0.3%