PT-2026-30761 · Unknown · Strawberry Graphql

Katzj + 1 · Published 2026-04-06 · Updated 2026-06-05 · CVE-2026-35523

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Strawberry GraphQL versions through 0.312.3

Description Strawberry GraphQL is susceptible to an authentication bypass on WebSocket subscription endpoints. The legacy graphql-ws subprotocol handler does not verify completion of a connection init handshake before processing start (subscription) messages. This allows an attacker to bypass the on ws connect authentication hook by connecting with the graphql-ws subprotocol and sending a start message directly, without a connection init message. The graphql-transport-ws subprotocol handler is not affected. Applications relying on on ws connect for authentication or authorization are affected.

Recommendations Upgrade to version 0.312.3 or later. Alternatively, disable the legacy graphql-ws subprotocol by setting subscription protocols=[GRAPHQL TRANSPORT WS PROTOCOL] on your GraphQL view/router.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-35523

GHSA-VPWC-V33Q-MQ89

PYSEC-2026-133

Affected Products

Strawberry Graphql

References · 11

• https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-vpwc-v33q-mq89 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vpwc-v33q-mq89 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35523 · Security Note
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2026-35523 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-133 · Vendor Advisory
• https://github.com/strawberry-graphql/strawberry · Note
• https://github.com/strawberry-graphql/strawberry/commit/0977a4e6b41b7cfe3e9d8ba84a43458a2b0c54c2 · Note
• https://github.com/strawberry-graphql/strawberry/releases/tag/0.312.3 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/strawberry-graphql/PYSEC-2026-133.yaml · Note
• https://twitter.com/CVEnew/status/2041570001313001602 · Twitter Post
• https://twitter.com/infoflowcloud/status/2041570776210456667 · Twitter Post