Is CVE-2026-35523 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-35523 being exploited in the wild.

How severe is CVE-2026-35523?

High severity, with a CVSS score of 7.5, published 6 April 2026.

Which products and versions are affected?

strawberry-graphql (PyPI) <= 0.312.2, ECOSYSTEM:introduced=0,fixed=0.312.3.

Is there a fix for CVE-2026-35523?

Yes. strawberry-graphql (PyPI): upgrade to 0.312.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-35523 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-35523?

Check whether you run strawberry-graphql (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-35523: strawberry-graphql authentication bypass in legacy WebSocket subprotocol

Q: Is there a fix for CVE-2026-35523?

Yes. strawberry-graphql (PyPI): upgrade to 0.312.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-35523 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-35523?

Check whether you run strawberry-graphql (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-35523 · Severity: high · CVSS 7.5 · Published 2026-04-06

Strawberry is a Python library used to build GraphQL interfaces for web applications. A security flaw in its WebSocket handling allows unauthorized users to bypass authentication checks when accessing real-time data subscriptions. This could lead to the exposure of sensitive information that should only be accessible to logged-in users.

Technologies: strawberry-graphql (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-35523 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-35523 being exploited in the wild.
How severe is CVE-2026-35523?: High severity, with a CVSS score of 7.5, published 6 April 2026.
Which products and versions are affected?: strawberry-graphql (PyPI) <= 0.312.2, ECOSYSTEM:introduced=0,fixed=0.312.3.
Is there a fix for CVE-2026-35523?: Yes. strawberry-graphql (PyPI): upgrade to 0.312.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-35523 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-35523?: Check whether you run strawberry-graphql (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

strawberry-graphql (PyPI): upgrade to 0.312.3 or later
```
pip install "strawberry-graphql>=0.312.3"
```

Technical details

Strawberry GraphQL (up to version 0.312.2) contains a missing authentication check (CWE-306) in its legacy 'graphql-ws' WebSocket subprotocol handler. The handler fails to verify that a 'connection_init' handshake has been completed before processing 'start' (subscription) messages. An attacker can exploit this by connecting via the legacy subprotocol and sending a subscription request directly, effectively skipping the 'on_ws_connect' authentication hook. While the newer 'graphql-transport-ws' protocol is not affected, both are enabled by default. The vulnerability is patched in version 0.312.3; users can also mitigate the risk by explicitly disabling the legacy subprotocol in their router configuration.

Affected products

strawberry-graphql strawberry-graphql <= 0.312.2

Identifiers

CVE-2026-35523
GHSA-vpwc-v33q-mq89
PYSEC-2026-133

Timeline

2026-04-04: disclosed: Initial disclosure by maintainers
2026-04-06: advisory: GitHub Advisory published
2026-04-07: other: NVD publication

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.