Sensitive Data Exposure in Strawberry GraphQL Library

CVE-2026-45739

What is CVE-2026-45739?

The Strawberry GraphQL library, used for creating GraphQL APIs, has a vulnerability that allows sensitive header values to be written into browser URL query strings. This occurs in versions 0.288.4 through 0.315.3 when users input headers like 'Authorization: Bearer '. Subsequently, these values become accessible in browser history, shared links, and server access logs, posing a serious risk of exposing sensitive user information. The issue has been addressed in version 0.315.4 with a patch ensuring that sensitive data remains protected.

References