PyPI/strawberry-graphql CVE-2026-45739: low 3.1, EPSS 0.22%

Strawberry GraphQL: Default GraphiQL may expose HTTP headers in URLs

Action: Upgrade strawberry-graphql to 0.315.4 or later.

pip install strawberry-graphql==0.315.4

Affected

Fixed versions

Sources

• osv: GHSA-x97m-qp5c-w9xj
• https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-x97m-qp5c-w9xj
• https://nvd.nist.gov/vuln/detail/CVE-2026-45739
• https://github.com/strawberry-graphql/strawberry/issues/4398
• https://github.com/strawberry-graphql/strawberry/pull/2842
• https://github.com/strawberry-graphql/strawberry/commit/9315ef80a621ae50ca0bc5c82f560ca4ee7e47a9
• https://github.com/strawberry-graphql/strawberry
• https://github.com/strawberry-graphql/strawberry/releases/tag/0.315.4

CVE-2026-45739 · published 2026-05-19T15:55:07Z · modified 2026-07-13T07:26:52.672764471Z · JSON