# CVE-2026-45739: Strawberry GraphQL sensitive information leak in GraphiQL template

Source: https://junglewise.ai/threats/cve-2026-45739-strawberry-graphql-sensitive-information-leak-in-graphiql  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-04. Updated: 2026-06-04  
License: CC BY 4.0 with a link back

CVE-2026-45739 · Severity: low · CVSS 3.1 · Published 2026-06-04

Strawberry GraphQL is a library used to build GraphQL APIs. A vulnerability in its built-in developer interface (GraphiQL) causes sensitive information, such as login tokens or authorization headers, to be saved directly into the browser's URL. This could lead to the accidental exposure of credentials through browser history, shared links, or server logs, potentially allowing unauthorized access to the API if those links or logs are intercepted.

Technologies: [strawberry-graphql (PyPI)](https://junglewise.ai/threats/technologies/strawberry-graphql). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-45739 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45739 being exploited in the wild.

**How severe is CVE-2026-45739?** Low severity, with a CVSS score of 3.1, published 4 June 2026.

**Which products and versions are affected?** strawberry-graphql (PyPI) >= 0.288.4, <= 0.315.3, ECOSYSTEM:introduced=0.288.4,fixed=0.315.4.

**Is there a fix for CVE-2026-45739?** Yes. strawberry-graphql (PyPI): upgrade to 0.315.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45739 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-45739?** Check whether you run strawberry-graphql (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- strawberry-graphql (PyPI): upgrade to 0.315.4 or later

  ```sh
  pip install "strawberry-graphql>=0.315.4"
  ```


## Technical details

A vulnerability exists in the GraphiQL template bundled with Strawberry GraphQL versions 0.288.4 through 0.315.3. The implementation of the 'URL sharing' feature incorrectly includes the contents of the headers editor in the browser's URL query string via 'history.replaceState' on every keystroke. Consequently, sensitive headers like 'Authorization: Bearer <token>' are persisted in the URL. This results in sensitive data being exposed in browser history, server/proxy/CDN access logs, and any shared links. The issue is resolved in version 0.315.4 by removing the automatic update of the URL when headers are edited, while still allowing headers to be persisted via localStorage.

## Affected products

- Strawberry GraphQL strawberry-graphql 0.288.4 - 0.315.3

## Identifiers

- CVE-2026-45739
- GHSA-x97m-qp5c-w9xj
- PYSEC-2026-2282

## Timeline

- 2026-01-12: other: Vulnerable URL sharing feature introduced in PR #2842
- 2026-05-06: disclosed: Issue reported to maintainers via GitHub issue #4398
- 2026-05-12: patched: Version 0.315.4 released
- 2026-05-13: advisory: GitHub Security Advisory published
- 2026-06-04: other: CVE-2026-45739 assigned/published in NVD

## References

- [https://github.com/strawberry-graphql/strawberry/commit/9315ef80a621ae50ca0bc5c82f560ca4ee7e47a9](https://github.com/strawberry-graphql/strawberry/commit/9315ef80a621ae50ca0bc5c82f560ca4ee7e47a9)
- [https://github.com/strawberry-graphql/strawberry/issues/4398](https://github.com/strawberry-graphql/strawberry/issues/4398)
- [https://github.com/strawberry-graphql/strawberry/pull/2842](https://github.com/strawberry-graphql/strawberry/pull/2842)
- [https://github.com/strawberry-graphql/strawberry/releases/tag/0.315.4](https://github.com/strawberry-graphql/strawberry/releases/tag/0.315.4)
- [https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-x97m-qp5c-w9xj](https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-x97m-qp5c-w9xj)

## Related threats

- [Strawberry GraphQL permission check bypass via awaitable return value](https://junglewise.ai/threats/cve-2026-107728-strawberry-graphql-synchronous-permission-checks-can-treat-an)
- [Strawberry legacy graphql-ws retains naturally completed subscription slots](https://junglewise.ai/threats/cve-2026-107727-strawberry-legacy-graphql-ws-retains-naturally-completed)
- [PYSEC-2026-1946 - Strawberry GraphQL has type resolution vulnerability in node interface that allows potential data…](https://junglewise.ai/threats/cve-2025-22151-strawberry-graphql-has-type-resolution-vulnerability-in-node)
- [Strawberry GraphQL DoS via MaxAliasesLimiter bypass in FragmentSpreadNode](https://junglewise.ai/threats/cve-2026-47707-strawberry-graphql-dos-via-maxaliaseslimiter-bypass-in)
- [Strawberry GraphQL Denial of Service via Uncontrolled Recursion in QueryDepthLimiter](https://junglewise.ai/threats/cve-2026-47706-strawberry-graphql-denial-of-service-via-uncontrolled-recursion)