PYSEC-2026-4303 Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy

Summary PermissionExtension.resolve evaluates the return value of haspermission for truthiness on the synchronous path. supportssync only classifies a permission as asynchronous when haspermission is declared with async def via inspect.iscoroutinefunction, so a plain def that returns an awaitable...

ROOT-APP-PYPI-CVE-2026-107728 CVE-2026-107728 in strawberry-graphql - Patched by Root

Root has patched CVE-2026-107728 in the strawberry-graphql package for Root:PyPI. Multiple fixed versions available...

airo-camera-toolkit (>=2025.4.0, <=2025.7.1), airo-dataset-tools (>=2025.4.0, <=2026.5.0) +35 more potentially affected by CVE-2026-107727 via strawberry-graphql (>=0.312.4, <=0.327.1)

strawberry-graphql PYPI version =0.312.4, =2025.4.0, =2025.4.0, =0.9.0, =26.4.0rc1, =0.1.0a1, =0.2.0, =1.0.1, =0.1.0, =1.17.0, =0.1.0, =0.0.246, =2.0.0, =0.0.1a0, =0.1.26, =1.1.3, =2.4.1 and more Source cves: CVE-2026-107727 Source advisory: OSV:GHSA-M952-2W3F-6R8H...

EUVD-2026-95391

Strawberry legacy graphql-ws retains naturally completed subscription slots...

airo-camera-toolkit (>=2025.4.0, <=2025.7.1), airo-dataset-tools (>=2025.4.0, <=2026.5.0) +35 more potentially affected by CVE-2026-107727 via strawberry-graphql (>=0.312.4, <=0.327.1)

strawberry-graphql PYPI version =0.312.4, =2025.4.0, =2025.4.0, =0.9.0, =26.4.0rc1, =0.1.0a1, =0.2.0, =1.0.1, =0.1.0, =1.17.0, =0.1.0, =0.0.246, =2.0.0, =0.0.1a0, =0.1.26, =1.1.3, =2.4.1 and more Source cves: CVE-2026-107727 Source advisory: GHSA-M952-2W3F-6R8H...

airo-camera-toolkit (>=2025.4.0, <=2025.7.1), airo-dataset-tools (>=2025.4.0, <=2026.5.0) +77 more potentially affected by CVE-2026-107728 via strawberry-graphql (>=0.217.0, <=0.325.0)

strawberry-graphql PYPI version =0.217.0, =2025.4.0, =2025.4.0, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.1.0, =0.9.0, =25.13.0rc1, =1.2.0, =0.1.0a1, =0.2.0, =1.0.1, =2.2.1 - dictatorgenai 0.1.0 and more Source cves: CVE-2026-107728 Source advisory: OSV:GHSA-PFVF-FWFP-25MP...

EUVD-2026-95392

Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy...

Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy

Summary PermissionExtension.resolve evaluates the return value of haspermission for truthiness on the synchronous path. supportssync only classifies a permission as asynchronous when haspermission is declared with async def via inspect.iscoroutinefunction, so a plain def that returns an awaitable...

GHSA-PFVF-FWFP-25MP Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy

Summary PermissionExtension.resolve evaluates the return value of haspermission for truthiness on the synchronous path. supportssync only classifies a permission as asynchronous when haspermission is declared with async def via inspect.iscoroutinefunction, so a plain def that returns an awaitable...

airo-camera-toolkit (>=2025.4.0, <=2025.7.1), airo-dataset-tools (>=2025.4.0, <=2026.5.0) +77 more potentially affected by CVE-2026-107728 via strawberry-graphql (>=0.217.0, <=0.325.0)

strawberry-graphql PYPI version =0.217.0, =2025.4.0, =2025.4.0, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.1.0, =0.9.0, =25.13.0rc1, =1.2.0, =0.1.0a1, =0.2.0, =1.0.1, =2.2.1 - dictatorgenai 0.1.0 and more Source cves: CVE-2026-107728 Source advisory: GHSA-PFVF-FWFP-25MP...

Incorrect Authorization

Overview strawberry-graphql is an A library for creating GraphQL APIs Affected versions of this package are vulnerable to Incorrect Authorization via the synchronous resolve method in strawberry/permission.py when a haspermission method is defined as a plain def that returns a coroutine awaitable...

CVE-2026-107727

A flaw was found in strawberry-graphql, which could lead to a denial of service DoS on affected connections. When a limit on subscriptions per connection is configured, the legacy subscription handler fails to properly remove completed operations from internal tracking. A remote client can exhaus...

CVE-2026-107728

Strawberry GraphQL is a library for creating GraphQL APIs. From 0.217.0 until 0.326.1, PermissionExtension.resolve on a synchronous field resolver evaluates the result of haspermission for truthiness. When a custom permission declares haspermission as a normal function but returns an awaitable,...

CVE-2026-107727

Strawberry GraphQL is a library for creating GraphQL APIs. From 0.312.3 until 0.327.2, the legacy graphql-ws subscription handler in strawberry/subscriptions/protocols/graphqlws/handlers.py does not remove naturally completed operations from self.tasks and self.subscriptions. When...

CVE-2026-107728

A flaw was found in strawberry-graphql. When evaluating permissions on synchronous field resolvers, the library fails to properly await asynchronous permission check results and treats the resulting objects as inherently valid. A remote attacker can exploit this flaw to bypass authorization check...

aas2openapi (>=0.2.0, <=0.2.4), adelecv (>=0.0.1, <=0.0.2) +115 more potentially affected by CVE-2026-107728 via strawberry-graphql (>=0.16.10, <=0.325.0)

strawberry-graphql PYPI version =0.16.10, =0.2.0, =0.0.1, =0.0.1, =2025.4.0, =2025.4.0, =0.1.1, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.1.0, =0.0.2rc0, =0.9.0, =25.13.0rc1, =26.9.3 and more Source cves: CVE-2026-107728 Source advisory: MEND:CVE-2026-107728...

CVE-2026-107728 Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy

Strawberry GraphQL is a library for creating GraphQL APIs. From 0.217.0 until 0.326.1, PermissionExtension.resolve on a synchronous field resolver evaluates the result of haspermission for truthiness. When a custom permission declares haspermission as a normal function but returns an awaitable,...

CVE-2026-107728

The Strawberry GraphQL library (versions 0.217.0 through 0.326.1) contains a vulnerability in PermissionExtension.resolve() where synchronous field resolvers may incorrectly grant access. When a custom permission's has_permission() is a normal function returning an awaitable, the system fails to ...

CVE-2026-107728 Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy

Strawberry GraphQL is a library for creating GraphQL APIs. From 0.217.0 until 0.326.1, PermissionExtension.resolve on a synchronous field resolver evaluates the result of haspermission for truthiness. When a custom permission declares haspermission as a normal function but returns an awaitable,...

CVE-2026-107728

Strawberry GraphQL is a library for creating GraphQL APIs. From 0.217.0 until 0.326.1, PermissionExtension.resolve on a synchronous field resolver evaluates the result of haspermission for truthiness. When a custom permission declares haspermission as a normal function but returns an awaitable,...