CVE-2026-45739: Strawberry GraphQL: Default GraphiQL may expose HTTP headers in URLs
(updated )
Strawberry’s bundled GraphiQL template wrote values from the GraphiQL headers editor into the browser URL query string. If a user entered a sensitive header, such as Authorization: Bearer <token>, the value could become visible in browser history, copied links, and server/proxy/CDN access logs after a page reload or shared request.
References
- github.com/advisories/GHSA-x97m-qp5c-w9xj
- github.com/strawberry-graphql/strawberry/commit/9315ef80a621ae50ca0bc5c82f560ca4ee7e47a9
- github.com/strawberry-graphql/strawberry/issues/4398
- github.com/strawberry-graphql/strawberry/pull/2842
- github.com/strawberry-graphql/strawberry/releases/tag/0.315.4
- github.com/strawberry-graphql/strawberry/security/advisories/GHSA-x97m-qp5c-w9xj
- nvd.nist.gov/vuln/detail/CVE-2026-45739
Code Behaviors & Features
Detect and mitigate CVE-2026-45739 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →