Strawberry GraphQL is a library for creating GraphQL APIs. Strawberry up until version 0.312.3 is vulnerable to an authentication bypass on WebSocket subscription endpoints. The legacy graphql-ws subprotocol handler does not verify that a connection_init handshake has been completed before processing start (subscription) messages. This allows a remote attacker to skip the on_ws_connect authentication hook entirely by connecting with the graphql-ws subprotocol and sending a start message directly, without ever sending connection_init. This vulnerability is fixed in 0.312.3.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade py310-strawberry-graphqlUpgrade py310-dj52-strawberry-graphqlUpgrade py314-strawberry-graphqlUpgrade py311-strawberry-graphqlUpgrade py313t-strawberry-graphqlUpgrade py311-dj52-strawberry-graphqlUpgrade py314-dj52-strawberry-graphqlUpgrade py313-strawberry-graphqlUpgrade py313t-dj52-strawberry-graphqlUpgrade py312-strawberry-graphqlUpgrade py313-dj52-strawberry-graphqlUpgrade py312-dj52-strawberry-graphql | Apr 20, 2026 | Apr 17, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub