CVE-2026-35523: Authentication Bypass in Strawberry GraphQL

An attacker can exploit this vulnerability by connecting to the WebSocket subscription endpoint using the legacy graphql-ws subprotocol. By sending a 'start' message directly without completing the connection handshake, the attacker can bypass the onwsconnect authentication hook. This effectively grants them access to subscription data and functionality without proper authentication. The impact could range from unauthorized data retrieval to potentially executing arbitrary code if the subscription logic is vulnerable. This bypass circumvents the intended security measures, allowing malicious actors to gain access to sensitive information or manipulate the GraphQL API.

1. Reserved2026-04-03
2. Published2026-04-07
3. Modified2026-04-09
4. EPSS updated2026-04-15

The primary mitigation for CVE-2026-35523 is to upgrade Strawberry GraphQL to version 0.312.3 or later, which includes the fix for this authentication bypass. If upgrading immediately is not feasible, consider implementing a temporary workaround by rigorously validating the connection handshake within your application logic. This might involve adding custom checks to ensure the connection_init message is received and processed before allowing any subscription messages. Additionally, review your WebSocket configuration to ensure the legacy graphql-ws subprotocol is not enabled unless absolutely necessary. After upgrading, confirm the fix by attempting to establish a WebSocket subscription connection without completing the handshake and verifying that the connection is rejected.