# CVE-2026-35523: strawberry-graphql authentication bypass in legacy WebSocket subprotocol

Source: https://junglewise.ai/threats/cve-2026-35523-strawberry-graphql-authentication-bypass-in-legacy-websocket  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-06. Updated: 2026-06-08  
License: CC BY 4.0 with a link back

CVE-2026-35523 · Severity: high · CVSS 7.5 · Published 2026-04-06

Strawberry is a Python library used to build GraphQL interfaces for web applications. A security flaw in its WebSocket handling allows unauthorized users to bypass authentication checks when accessing real-time data subscriptions. This could lead to the exposure of sensitive information that should only be accessible to logged-in users.

Technologies: [strawberry-graphql (PyPI)](https://junglewise.ai/threats/technologies/strawberry-graphql). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-35523 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-35523 being exploited in the wild.

**How severe is CVE-2026-35523?** High severity, with a CVSS score of 7.5, published 6 April 2026.

**Which products and versions are affected?** strawberry-graphql (PyPI) <= 0.312.2, ECOSYSTEM:introduced=0,fixed=0.312.3.

**Is there a fix for CVE-2026-35523?** Yes. strawberry-graphql (PyPI): upgrade to 0.312.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-35523 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-35523?** Check whether you run strawberry-graphql (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- strawberry-graphql (PyPI): upgrade to 0.312.3 or later

  ```sh
  pip install "strawberry-graphql>=0.312.3"
  ```


## Technical details

Strawberry GraphQL (up to version 0.312.2) contains a missing authentication check (CWE-306) in its legacy 'graphql-ws' WebSocket subprotocol handler. The handler fails to verify that a 'connection_init' handshake has been completed before processing 'start' (subscription) messages. An attacker can exploit this by connecting via the legacy subprotocol and sending a subscription request directly, effectively skipping the 'on_ws_connect' authentication hook. While the newer 'graphql-transport-ws' protocol is not affected, both are enabled by default. The vulnerability is patched in version 0.312.3; users can also mitigate the risk by explicitly disabling the legacy subprotocol in their router configuration.

## Affected products

- strawberry-graphql strawberry-graphql <= 0.312.2

## Identifiers

- CVE-2026-35523
- GHSA-vpwc-v33q-mq89
- PYSEC-2026-133

## Timeline

- 2026-04-04: disclosed: Initial disclosure by maintainers
- 2026-04-06: advisory: GitHub Advisory published
- 2026-04-07: other: NVD publication

## References

- [https://api.github.com/users/bellini666](https://api.github.com/users/bellini666)
- [https://github.com/bellini666](https://github.com/bellini666)
- [https://api.github.com/users/bellini666/gists%7B/gist_id%7D](https://api.github.com/users/bellini666/gists%7B/gist_id%7D)
- [https://api.github.com/users/bellini666/repos](https://api.github.com/users/bellini666/repos)
- [https://avatars.githubusercontent.com/u/134025?v=4](https://avatars.githubusercontent.com/u/134025?v=4)
- [https://api.github.com/users/bellini666/events%7B/privacy%7D](https://api.github.com/users/bellini666/events%7B/privacy%7D)

## Related threats

- [Strawberry GraphQL permission check bypass via awaitable return value](https://junglewise.ai/threats/cve-2026-107728-strawberry-graphql-synchronous-permission-checks-can-treat-an)
- [Strawberry legacy graphql-ws retains naturally completed subscription slots](https://junglewise.ai/threats/cve-2026-107727-strawberry-legacy-graphql-ws-retains-naturally-completed)
- [PYSEC-2026-1946 - Strawberry GraphQL has type resolution vulnerability in node interface that allows potential data…](https://junglewise.ai/threats/cve-2025-22151-strawberry-graphql-has-type-resolution-vulnerability-in-node)
- [Strawberry GraphQL DoS via MaxAliasesLimiter bypass in FragmentSpreadNode](https://junglewise.ai/threats/cve-2026-47707-strawberry-graphql-dos-via-maxaliaseslimiter-bypass-in)
- [Strawberry GraphQL Denial of Service via Uncontrolled Recursion in QueryDepthLimiter](https://junglewise.ai/threats/cve-2026-47706-strawberry-graphql-denial-of-service-via-uncontrolled-recursion)