Strawberry-graphql vulnerabilities
We track 4 vulnerabilities in Strawberry-graphql products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on October 8, 2026.
Latest Strawberry-graphql vulnerabilities
- 7.5 High severity
strawberry: Incorrect Authorization
Strawberry GraphQL is a library for creating GraphQL APIs. From 0.217.0 until 0.326.1, PermissionExtension.resolve() on a synchronous field resolver evaluates the result of has_permission() for truthiness. When a custom permission declares has_permission() as
- 7.5 High severity
strawberry: Missing Authentication for Critical Functionality
Strawberry GraphQL is a library for creating GraphQL APIs. Strawberry up until version 0.312.3 is vulnerable to an authentication bypass on WebSocket subscription endpoints. The legacy graphql-ws subprotocol handler does not verify that a connection_init hands
- 7.5 High severity
strawberry: Allocation of Resources Without Limits or Throttling
Strawberry GraphQL is a library for creating GraphQL APIs. Prior to 0.312.3, Strawberry GraphQL's WebSocket subscription handlers for both the graphql-transport-ws and legacy graphql-ws protocols allocate an asyncio.Task and associated Operation object for eve
- 8.0 High severity
strawberry: Cross-Site Request Forgery
Strawberry GraphQL is a library for creating GraphQL APIs. Prior to version 0.243.0, multipart file upload support as defined in the GraphQL multipart request specification was enabled by default in all Strawberry HTTP view integrations. This made all Strawber