The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Strawberry GraphQL is a library for creating GraphQL APIs. Strawberry up until version 0.312.3 is vulnerable to an authentication bypass on WebSocket subscription endpoints. The legacy graphql-ws subprotocol handler does not verify that a connection_init handshake has been completed before processing start (subscription) messages. This allows a remote attacker to skip the on_ws_connect authentication hook entirely by connecting with the graphql-ws subprotocol and sending a start message directly, without ever sending connection_init. This vulnerability is fixed in 0.312.3.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade py313-dj52-strawberry-graphqlUpgrade py313-strawberry-graphqlUpgrade py312-dj52-strawberry-graphqlUpgrade py313t-dj52-strawberry-graphqlUpgrade py312-strawberry-graphqlUpgrade py314-strawberry-graphqlUpgrade py314-dj52-strawberry-graphqlUpgrade py311-dj52-strawberry-graphqlUpgrade py310-strawberry-graphqlUpgrade py310-dj52-strawberry-graphqlUpgrade py313t-strawberry-graphqlUpgrade py311-strawberry-graphql | Apr 20, 2026 | Apr 17, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub