CVE-2026-41522

Affected software: Iris DFIR-IRIS web collaboration platform. Vulnerable version: earlier than 2.4.28. Issue: optional GraphQL endpoint at /graphql did not enforce the same authorization as the REST API, enabling three unauthorized actions by any authenticated user: (1) IOC read across cases (IDO...

CVE-2026-41522 Iris has an Improper Authorization issue

Iris is a web collaborative platform that helps incident responders share technical details during investigations. Prior to version 2.4.28, DFIR-IRIS exposes an optional GraphQL endpoint at /graphql that does not enforce the same authorization checks as the REST API. Any authenticated user can...

CVE-2026-41522

Iris is a web collaborative platform that helps incident responders share technical details during investigations. Prior to version 2.4.28, DFIR-IRIS exposes an optional GraphQL endpoint at "/graphql" that does not enforce the same authorization checks as the REST API. Any authenticated user can...

Mozilla: Unauthenticated RCE in Taskcluster web-server via GraphQL filter argument (sift $where)

A vulnerability was discovered in the Taskcluster web-server that allowed unauthenticated remote code execution through the GraphQL filter argument. The issue was caused by the use of the 'sift' library, which compiled the filter's '$where' string into a function using 'new Function' and executed...

Nhost CLI local configserver allows cross-origin unauthenticated read/write access to local development configuration and secrets

Summary The hidden nhost configserver used by nhost dev exposes the Mimir GraphQL API with dummy authorization directives and permissive CORS. When a developer is running the local development environment, any process that can reach the developer's localhost service, including a web page loaded...

Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function in the configserver process. An attacker can access and modify sensitive configuration and secret data by sending cross-origin GraphQL requests to the local development server without...

Allocation of Resources Without Limits or Throttling

Overview strawberry-graphql is an A library for creating GraphQL APIs Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the MaxAliasesLimiter extension. An attacker can exhaust server resources by crafting GraphQL queries that exploit...

aas2openapi (>=0.2.0, <=0.2.4), alchemy-graph (>=0.1.1, <=0.1.2) +65 more potentially affected by CVE-2026-47707 via strawberry-graphql (>=0.174.0, <=0.315.2)

strawberry-graphql PYPI version =0.174.0, =0.2.0, =0.1.1, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.1.0, =0.0.20rc0, =25.13.0rc1, =1.2.0, =0.4.0, =1.1.20, =0.1.2, =0.1.3.60 and more Source cves: CVE-2026-47707 Source advisory: SNYK:PYTHON-STRAWBERRYGRAPHQL-17173197...

PYSEC-2026-2284

Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.172.0 through0.315.6, the MaxAliasesLimiter extension in Strawberry fails to account for the multiplicative/amplification effect of FragmentSpreadNode. While it correctly counts static aliases within the AST it does not...

PYSEC-2026-2284

Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.172.0 through0.315.6, the MaxAliasesLimiter extension in Strawberry fails to account for the multiplicative/amplification effect of FragmentSpreadNode. While it correctly counts static aliases within the AST it does not...

aas2openapi (>=0.2.0, <=0.2.4), alchemy-graph (>=0.1.1, <=0.1.2) +65 more potentially affected by CVE-2026-47707 via strawberry-graphql (>=0.174.0, <=0.315.2)

strawberry-graphql PYPI version =0.174.0, =0.2.0, =0.1.1, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.1.0, =0.0.20rc0, =25.13.0rc1, =1.2.0, =0.4.0, =1.1.20, =0.1.2, =0.1.3.60 and more Source cves: CVE-2026-47707 Source advisory: OSV:PYSEC-2026-2284...

CVE-2026-47707

Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.172.0 through0.315.6, the MaxAliasesLimiter extension in Strawberry fails to account for the multiplicative/amplification effect of FragmentSpreadNode. While it correctly counts static aliases within the AST it does not...

PYSEC-2026-2283

Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.71.0 through 0.315.6, the QueryDepthLimiter extension is vulnerable to an Application-level DOS due to a lack of cycle detection in fragment spreads. When a query contains circular fragment references the determinedepth...

PYSEC-2026-2283

Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.71.0 through 0.315.6, the QueryDepthLimiter extension is vulnerable to an Application-level DOS due to a lack of cycle detection in fragment spreads. When a query contains circular fragment references the determinedepth...

backend-ai-manager (>=26.4.0rc1, <=26.8.3), bootgraph (>=1.20.0.dev34111, <=1.21.0) +10 more potentially affected by CVE-2026-45739 via strawberry-graphql (>=0.288.4, <=0.315.2)

strawberry-graphql PYPI version =0.288.4, =26.4.0rc1, =1.20.0.dev34111, =1.1.20, =1.13.1, =1.0.0, =4.5.4, =1.0.0, =0.1.0, =0.2.1, =0.6.7 Source cves: CVE-2026-45739 Source advisory: OSV:PYSEC-2026-2282...

aas2openapi (>=0.2.0, <=0.2.4), adelecv (>=0.0.1, <=0.0.2) +82 more potentially affected by CVE-2026-47706 via strawberry-graphql (>=0.73.9, <=0.315.2)

strawberry-graphql PYPI version =0.73.9, =0.2.0, =0.0.1, =0.1.1, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.1.0, =0.0.2rc0, =25.13.0rc1, =1.2.0, =0.1.1, =0.2.0, =0.9.0, =0.9.1 and more Source cves: CVE-2026-47706 Source advisory: OSV:PYSEC-2026-2283...

CVE-2026-45739

Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.288.4 through 0.315.3, Strawberry's bundled GraphiQL template wrote values from the GraphiQL headers editor into the browser URL query string. If a user entered a sensitive header, such as Authorization: Bearer , the value...

CVE-2026-47706

Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.71.0 through 0.315.6, the QueryDepthLimiter extension is vulnerable to an Application-level DOS due to a lack of cycle detection in fragment spreads. When a query contains circular fragment references the determinedepth...

PYSEC-2026-2282

Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.288.4 through 0.315.3, Strawberry's bundled GraphiQL template wrote values from the GraphiQL headers editor into the browser URL query string. If a user entered a sensitive header, such as Authorization: Bearer , the value...

Strawberry GraphQL's Bypass of MaxAliasesLimiter via Fragment Spreads leading to GraphQL Alias Amplification

Summary The MaxAliasesLimiter extension in Strawberry fails to account for the multiplicative/amplification effect of FragmentSpreadNode. While it correctly counts static aliases within the AST it does not consider how many times a fragments internal aliases are expanded during execution. this...