CVE-2026-107728: Strawberry GraphQL Synchronous Permission Check Vulnerability

Sponsored Habilume Habit tracker with a companion that grows with you Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent. App Store Google Play

Background

Strawberry GraphQL is a Python library that allows developers to create GraphQL APIs easily. It provides a simple and intuitive way to define schemas and resolvers, enabling seamless integration with Python applications. The library supports both synchronous and asynchronous operations, making it versatile for various use cases. However, it is susceptible to a vulnerability in its permission handling mechanism, which can lead to unauthorized access to protected fields.

Vulnerability Detail

The vulnerability arises from the way the PermissionExtension.resolve() method evaluates the return value of the has_permission() function. If has_permission() is defined as a synchronous function that returns an awaitable, the system treats it as truthy without awaiting its result. This can lead to unauthorized access since an awaitable is always considered truthy, allowing the protected resolver to execute even when access should be denied. This issue affects any field with a synchronous resolver under both execute_sync() and execute() methods, posing a significant security risk.

pip install --upgrade "strawberry-graphql==0.336.2"

pip install --upgrade "strawberry-graphql==0.326.1"

Workaround

As a temporary workaround, ensure that your has_permission() function is defined as an asynchronous function (using async def) or returns a boolean value directly, rather than returning an awaitable from a synchronous function. Here is an example of a corrected permission class:

import strawberry
from strawberry.permission import BasePermission

class DenyViaAwaitable(BasePermission):
    message = "denied"

    async def has_permission(self, source, info, **kwargs):
        return False

@strawberry.type
class Query:
    @strawberry.field(permission_classes=[DenyViaAwaitable])
    def secret(self) -> str:
        return "secret"

schema = strawberry.Schema(Query)

Conclusion

The CVE-2026-107728 vulnerability in the Strawberry GraphQL library poses a significant risk by allowing unauthorized access to protected fields through improper permission checks. It is crucial to update to the patched version or implement the recommended workarounds to secure your application.

See every vulnerability recorded for strawberry-graphql →

FAQ