CVE-2026-45739: Strawberry GraphQL: Default GraphiQL may expose HTTP headers in URLs
(updated )
Strawberry’s bundled GraphiQL template wrote values from the GraphiQL headers editor into the browser URL query string. If a user entered a sensitive header, such as Authorization: Bearer <token>, the value could become visible in browser history, copied links, and server/proxy/CDN access logs after a page reload or shared request.
References
- github.com/advisories/GHSA-x97m-qp5c-w9xj
- github.com/strawberry-graphql/strawberry/commit/9315ef80a621ae50ca0bc5c82f560ca4ee7e47a9
- github.com/strawberry-graphql/strawberry/issues/4398
- github.com/strawberry-graphql/strawberry/pull/2842
- github.com/strawberry-graphql/strawberry/releases/tag/0.315.4
- github.com/strawberry-graphql/strawberry/security/advisories/GHSA-x97m-qp5c-w9xj
- nvd.nist.gov/vuln/detail/CVE-2026-45739
Code Behaviors & Features
Detect and mitigate CVE-2026-45739 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →