CVE-2026-35523

Strawberry GraphQL versions prior to 0.312.3 contain an authentication bypass vulnerability in WebSocket subscription endpoints. The legacy graphql-ws subprotocol handler fails to verify connection initialization before processing subscription messages, allowing attackers to circumvent the on_ws_connect authentication hook by sending a start message directly without completing the required handshake. The vulnerability carries a CVSS score of 7.5 (High) with a network-based attack vector requiring no special privileges or user interaction. While the attack complexity is low and could result in unauthorized information disclosure, integrity and availability impacts are not present. The EPSS score of 0.00125 indicates this vulnerability has relatively low predicted exploitation probability compared to the broader CVE landscape. There is currently no evidence of active exploitation or public exploit code availability for this vulnerability. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog, and community attention remains minimal, as reflected by its inactive status on threat monitoring platforms. Organizations should prioritize updating to version 0.312.3 to eliminate this authentication bypass vector, particularly for deployments relying on GraphQL WebSocket subscriptions.