CVE-2026-35523 Details
Description
Strawberry GraphQL is a library for creating GraphQL APIs. Strawberry up until version 0.312.3 is vulnerable to an authentication bypass on WebSocket subscription endpoints. The legacy graphql-ws subprotocol handler does not verify that a connection_init handshake has been completed before processing start (subscription) messages. This allows a remote attacker to skip the on_ws_connect authentication hook entirely by connecting with the graphql-ws subprotocol and sending a start message directly, without ever sending connection_init. This vulnerability is fixed in 0.312.3.
An authentication bypass vulnerability has been identified in Strawberry GraphQL versions through 0.312.2, specifically on WebSocket subscription endpoints. The issue arises in the legacy graphql-ws subprotocol handler, which fails to ensure that a connection_init handshake is completed before processing start (subscription) messages. This flaw allows remote attackers to bypass the on_ws_connect authentication hook by connecting with the graphql-ws subprotocol and directly sending a start message, without initiating the required connection_init first. The vulnerability is not present in the graphql-transport-ws subprotocol, which properly manages subscription operations by waiting for a connection_acknowledged flag. However, both subprotocols are enabled by default in all framework integrations that support WebSockets, with the client selecting the subprotocol via the Sec-WebSocket-Protocol header.
Users are advised to upgrade to Strawberry GraphQL version 0.312.3 or later. Alternatively, the legacy graphql-ws subprotocol can be disabled by setting subscription_protocols=[GRAPHQL_TRANSPORT_WS_PROTOCOL] on the GraphQL view or router.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-vpwc-v33q-mq89 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| strawberry strawberry graphql | < 0.312.3 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 17, 2026 | Initial Analysis | [email protected] |
| Apr 7, 2026 | New CVE Received | [email protected] |