CVE-2026-45739 Details

A vulnerability in Strawberry GraphQL's default GraphiQL template allows HTTP header values, including sensitive information like Authorization tokens, to be unintentionally written into the browser URL. This issue affects Strawberry GraphQL versions 0.288.4 prior to 0.315.3. The vulnerability arises because the GraphiQL headers editor updates the URL with header values on each edit, which can then be shared or logged, exposing the sensitive information. The issue can be reproduced by entering a token into the headers editor, which will then be reflected in the URL and can be logged or shared, thereby exposing the token.

Users can update to Strawberry GraphQL version 0.315.4 or later, where this issue is fixed. Alternatively, the default GraphiQL IDE can be disabled in production applications by setting 'graphql_ide=None' on the GraphQL router.