CVE-2026-45739: Strawberry GraphQL sensitive information leak in GraphiQL template

CVE-2026-45739 · Severity: low · CVSS 3.1 · Published 2026-06-04

Strawberry GraphQL is a library used to build GraphQL APIs. A vulnerability in its built-in developer interface (GraphiQL) causes sensitive information, such as login tokens or authorization headers, to be saved directly into the browser's URL. This could lead to the accidental exposure of credentials through browser history, shared links, or server logs, potentially allowing unauthorized access to the API if those links or logs are intercepted.

Technologies: strawberry-graphql (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-45739 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-45739 being exploited in the wild.
How severe is CVE-2026-45739?
Low severity, with a CVSS score of 3.1, published 4 June 2026.
Which products and versions are affected?
strawberry-graphql (PyPI) >= 0.288.4, <= 0.315.3, ECOSYSTEM:introduced=0.288.4,fixed=0.315.4.
Is there a fix for CVE-2026-45739?
Yes. strawberry-graphql (PyPI): upgrade to 0.315.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45739 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-45739?
Check whether you run strawberry-graphql (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • strawberry-graphql (PyPI): upgrade to 0.315.4 or later
    pip install "strawberry-graphql>=0.315.4"

Technical details

A vulnerability exists in the GraphiQL template bundled with Strawberry GraphQL versions 0.288.4 through 0.315.3. The implementation of the 'URL sharing' feature incorrectly includes the contents of the headers editor in the browser's URL query string via 'history.replaceState' on every keystroke. Consequently, sensitive headers like 'Authorization: Bearer <token>' are persisted in the URL. This results in sensitive data being exposed in browser history, server/proxy/CDN access logs, and any shared links. The issue is resolved in version 0.315.4 by removing the automatic update of the URL when headers are edited, while still allowing headers to be persisted via localStorage.

Affected products

  • Strawberry GraphQL strawberry-graphql 0.288.4 - 0.315.3

Identifiers

  • CVE-2026-45739
  • GHSA-x97m-qp5c-w9xj
  • PYSEC-2026-2282

Timeline

  • 2026-01-12: other: Vulnerable URL sharing feature introduced in PR #2842
  • 2026-05-06: disclosed: Issue reported to maintainers via GitHub issue #4398
  • 2026-05-12: patched: Version 0.315.4 released
  • 2026-05-13: advisory: GitHub Security Advisory published
  • 2026-06-04: other: CVE-2026-45739 assigned/published in NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.