CVE-2026-35413

Directus CVE-2026-35413 exposes schema structure via the server_specs_graphql resolver on /graphql/system when GRAPHQL_INTROSPECTION is false. Multiple trusted sources (Directus advisories, Red Hat, OSV, Snyk, etc.) confirm that before version 11.16.1, SDL-style schema data could be retrieved by ...

CVE-2026-35413

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, when GRAPHQLINTROSPECTION=false is configured, Directus correctly blocks standard GraphQL introspection queries schema, type. However, the serverspecsgraphql resolver on the /graphql/system endpoint...

CVE-2026-35413 Directus GraphQL Schema SDL Disclosure Setting

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, when GRAPHQLINTROSPECTION=false is configured, Directus correctly blocks standard GraphQL introspection queries schema, type. However, the serverspecsgraphql resolver on the /graphql/system endpoint...

CVE-2026-35413 Directus GraphQL Schema SDL Disclosure Setting

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, when GRAPHQLINTROSPECTION=false is configured, Directus correctly blocks standard GraphQL introspection queries schema, type. However, the serverspecsgraphql resolver on the /graphql/system endpoint...

CVE-2026-35413 Directus GraphQL Schema SDL Disclosure Setting

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, when GRAPHQLINTROSPECTION=false is configured, Directus correctly blocks standard GraphQL introspection queries schema, type. However, the serverspecsgraphql resolver on the /graphql/system endpoint...

kedro-graphql (>=1.1.0, <=1.5.1) potentially affected by CVE-2026-35171 via kedro (0.19.11)

kedro PYPI version 0.19.11 is affected by a known vulnerability. The following packages have a transitive dependency on kedro and may be impacted: - kedro-graphql =1.1.0, =1.5.1 Source cves: CVE-2026-35171 Source advisory: OSV:PYSEC-2026-72...

kedro-graphql (>=1.1.0, <=1.5.1) potentially affected by CVE-2026-35167 via kedro (0.19.11)

kedro PYPI version 0.19.11 is affected by a known vulnerability. The following packages have a transitive dependency on kedro and may be impacted: - kedro-graphql =1.1.0, =1.5.1 Source cves: CVE-2026-35167 Source advisory: OSV:PYSEC-2026-71...

GHSA-HV3W-M4G2-5X77 strawberry-graphql: Denial of Service via unbounded WebSocket subscriptions

Strawberry GraphQL's WebSocket subscription handlers for both the graphql-transport-ws and legacy graphql-ws protocols allocate an asyncio.Task and associated Operation object for every incoming subscribe message without enforcing any limit on the number of active subscriptions per connection. An...

Allocation of Resources Without Limits or Throttling

Overview strawberry-graphql is an A library for creating GraphQL APIs Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the WebSocket subscription handling process. An attacker can exhaust server resources by sending a large number of...

aas2openapi (>=0.2.0, <=0.2.4), adelecv (>=0.0.1, <=0.0.2) +85 more potentially affected by CVE-2026-35526 via strawberry-graphql (>=0.16.10, <=0.312.0)

strawberry-graphql PYPI version =0.16.10, =0.2.0, =0.0.1, =0.0.1, =0.1.1, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.1.0, =0.0.2rc0, =25.13.0rc1, =1.2.0, =0.1.1, =0.2.0, =0.21.0 and more Source cves: CVE-2026-35526 Source advisory: SNYK:PYTHON-STRAWBERRYGRAPHQL-15922315...

aas2openapi (>=0.2.0, <=0.2.4), adelecv (>=0.0.1, <=0.0.2) +85 more potentially affected by CVE-2026-35526 via strawberry-graphql (>=0.16.10, <=0.312.0)

strawberry-graphql PYPI version =0.16.10, =0.2.0, =0.0.1, =0.0.1, =0.1.1, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.1.0, =0.0.2rc0, =25.13.0rc1, =1.2.0, =0.1.1, =0.2.0, =0.21.0 and more Source cves: CVE-2026-35526 Source advisory: OSV:GHSA-HV3W-M4G2-5X77...

strawberry-graphql: Denial of Service via unbounded WebSocket subscriptions

Strawberry GraphQL's WebSocket subscription handlers for both the graphql-transport-ws and legacy graphql-ws protocols allocate an asyncio.Task and associated Operation object for every incoming subscribe message without enforcing any limit on the number of active subscriptions per connection. An...

aas2openapi (>=0.2.0, <=0.2.4), adelecv (>=0.0.1, <=0.0.2) +85 more potentially affected by CVE-2026-35526 via strawberry-graphql (>=0.16.10, <=0.312.0)

strawberry-graphql PYPI version =0.16.10, =0.2.0, =0.0.1, =0.0.1, =0.1.1, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.1.0, =0.0.2rc0, =25.13.0rc1, =1.2.0, =0.1.1, =0.2.0, =0.21.0 and more Source cves: CVE-2026-35526 Source advisory: GHSA-HV3W-M4G2-5X77...

strawberry-graphql: Authentication bypass via legacy graphql-ws WebSocket subprotocol

Strawberry up until version 0.312.3 is vulnerable to an authentication bypass on WebSocket subscription endpoints. The legacy graphql-ws subprotocol handler does not verify that a connectioninit handshake has been completed before processing start subscription messages. This allows a remote...

Missing Authentication for Critical Function

Overview strawberry-graphql is an A library for creating GraphQL APIs Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the onwsconnect process. An attacker can gain unauthorized access to WebSocket subscription endpoints by connecting with the...

aas2openapi (>=0.2.0, <=0.2.4), adelecv (>=0.0.1, <=0.0.2) +85 more potentially affected by CVE-2026-35523 via strawberry-graphql (>=0.16.10, <=0.312.0)

strawberry-graphql PYPI version =0.16.10, =0.2.0, =0.0.1, =0.0.1, =0.1.1, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.1.0, =0.0.2rc0, =25.13.0rc1, =1.2.0, =0.1.1, =0.2.0, =0.21.0 and more Source cves: CVE-2026-35523 Source advisory: GHSA-VPWC-V33Q-MQ89...

GHSA-VPWC-V33Q-MQ89 strawberry-graphql: Authentication bypass via legacy graphql-ws WebSocket subprotocol

Strawberry up until version 0.312.3 is vulnerable to an authentication bypass on WebSocket subscription endpoints. The legacy graphql-ws subprotocol handler does not verify that a connectioninit handshake has been completed before processing start subscription messages. This allows a remote...

aas2openapi (>=0.2.0, <=0.2.4), adelecv (>=0.0.1, <=0.0.2) +85 more potentially affected by CVE-2026-35523 via strawberry-graphql (>=0.16.10, <=0.312.0)

strawberry-graphql PYPI version =0.16.10, =0.2.0, =0.0.1, =0.0.1, =0.1.1, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.1.0, =0.0.2rc0, =25.13.0rc1, =1.2.0, =0.1.1, =0.2.0, =0.21.0 and more Source cves: CVE-2026-35523 Source advisory: OSV:GHSA-VPWC-V33Q-MQ89...

aas2openapi (>=0.2.0, <=0.2.4), adelecv (>=0.0.1, <=0.0.2) +85 more potentially affected by CVE-2026-35523 via strawberry-graphql (>=0.16.10, <=0.312.0)

strawberry-graphql PYPI version =0.16.10, =0.2.0, =0.0.1, =0.0.1, =0.1.1, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.1.0, =0.0.2rc0, =25.13.0rc1, =1.2.0, =0.1.1, =0.2.0, =0.21.0 and more Source cves: CVE-2026-35523 Source advisory: SNYK:PYTHON-STRAWBERRYGRAPHQL-15922312...

kedro-azureml (0.9.0), kedro-graphql (>=1.1.0, <=1.5.1) +4 more potentially affected by CVE-2026-111170 +1 more via kedro-datasets (7.0.0)

kedro-datasets PYPI version 7.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on kedro-datasets and may be impacted: - kedro-azureml 0.9.0 - kedro-graphql =1.1.0, =0.12.2, =0.7.0, =0.1.0, =0.1.3 Source cves: CVE-2026-111170, CVE-2026-35492 Source...