CVE-2026-35523

An attacker can exploit this vulnerability by connecting to the Strawberry GraphQL WebSocket subscription endpoint using the graphql-ws subprotocol. By directly sending a 'start' message without completing the connectioninit handshake, the attacker can circumvent the onws_connect authentication hook entirely. This effectively grants them access to subscribed data and functionality without proper authentication. The potential impact includes unauthorized data retrieval, modification, or even injection of malicious data into the GraphQL API, depending on the application's logic and data sensitivity. This bypass could be leveraged to gain access to sensitive user data or disrupt the service.

Applications utilizing Strawberry GraphQL for building GraphQL APIs, particularly those relying on WebSocket subscriptions for real-time data updates, are at risk. Systems with legacy graphql-ws subprotocol enabled are especially vulnerable. Developers who have not recently updated their Strawberry GraphQL dependencies should prioritize patching.

• python / server:

import websocket

ws = websocket.WebSocket()
ws.connect('ws://your-graphql-endpoint')
ws.send('{"id":"1","type":"subscription","payload":{"query":"subscription MySubscription { ... }","variables":{}}}
')

# If the connection proceeds without handshake verification, the system is vulnerable.

1. 2026-04-07Disclosure

   disclosure

1. Reserviert2026-04-03
2. Veröffentlicht2026-04-07
3. Geändert2026-04-09
4. EPSS aktualisiert2026-04-15

The primary mitigation for CVE-2026-35523 is to upgrade Strawberry GraphQL to version 0.312.3 or later, which includes the necessary handshake verification fix. If upgrading immediately is not feasible, consider implementing a temporary workaround by rigorously validating the connectioninit handshake within the onwsconnect hook. This might involve checking for specific headers or parameters expected in the handshake. Additionally, consider implementing a Web Application Firewall (WAF) rule to block connections using the graphql-ws subprotocol that do not include a valid connectioninit message. After upgrading, confirm the fix by attempting to establish a WebSocket subscription connection without sending a connection_init message; the connection should be rejected.