CVE-2026-45739
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
In Strawberry GraphQL versions 0.288.4 through 0.315.3, the bundled GraphiQL template wrote header editor values into the browser URL query string. This could expose sensitive headers like authorization tokens.
Risk Assessment
Users may inadvertently expose their authorization tokens via browser history, copied links, or server/proxy/CDN access logs.
Recommendation
Immediately update Strawberry GraphQL to version 0.315.4, which contains the fix.
Original NVD description (English source)
Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.288.4 through 0.315.3, Strawberry's bundled GraphiQL template wrote values from the GraphiQL headers editor into the browser URL query string. If a user entered a sensitive header, such as `Authorization: Bearer <token>`, the value could become visible in browser history, copied links, and server/proxy/CDN access logs after a page reload or shared request. Version 0.315.4 patches the issue.