CVE-2026-45739

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-45739
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45739.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-45739
Aliases
Published
2026-06-04T14:09:03Z
Modified
2026-08-12T03:51:45Z
Severity
  • 3.1 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Strawberry GraphQL: Default GraphiQL may expose HTTP headers in URLs
Details

Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.288.4 through 0.315.3, Strawberry's bundled GraphiQL template wrote values from the GraphiQL headers editor into the browser URL query string. If a user entered a sensitive header, such as Authorization: Bearer <token>, the value could become visible in browser history, copied links, and server/proxy/CDN access logs after a page reload or shared request. Version 0.315.4 patches the issue.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-200",
        "CWE-201"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45739.json"
}
References

Affected packages

Git / github.com/strawberry-graphql/strawberry

Affected ranges

Type
GIT
Repo
https://github.com/strawberry-graphql/strawberry
Events
Introduced
85ab96f563f292b2895fe71a216ec83ded614e0e
Fixed
9818abce8195a74eca40d353264659169f2493da
Fixed
9315ef80a621ae50ca0bc5c82f560ca4ee7e47a9
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:strawberry:strawberry_graphql:*:*:*:*:*:python:*:*",
    "extracted_events": [
        {
            "introduced": "0.288.4"
        },
        {
            "fixed": "0.315.4"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.288.4
0.289.0
0.289.1
0.289.2
0.289.3
0.289.4
0.289.5
0.289.6
0.289.7
0.289.8
0.290.0
0.291.0
0.291.1
0.291.2
0.291.3
0.292.0
0.293.0
0.294.0
0.295.0
0.296.0
0.296.1
0.296.2
0.297.0
0.298.0
0.298.1
0.299.0
0.300.0
0.301.0
0.302.0
0.303.0
0.303.1
0.304.0
0.305.0
0.306.0
0.307.0
0.307.1
0.308.0
0.308.1
0.308.2
0.308.3
0.309.0
0.310.0
0.310.1
0.310.2
0.311.0
0.311.1
0.311.2
0.311.3
0.312.0
0.312.1
0.312.2
0.312.3
0.312.4
0.313.0
0.314.0
0.314.1
0.314.2
0.314.3
0.315.0
0.315.1
0.315.2
0.315.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45739.json"