CVE-2026-33756

Saleor is an e-commerce platform. From 2.0.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, Saleor supports query batching by submitting multiple GraphQL operations in a single HTTP request as a JSON array but wasn't enforcing any upper limit on the number of operations. This allowed an unauthenticated attacker to send a single HTTP request many operations (bypassing the per query complexity limit) to exhaust resources. This vulnerability is fixed in 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118.

• CWE-770

• https://github.com/saleor/saleor/commit/7be352fa8c35875d6e66d36493ca7c14c101bd64Patch
• https://github.com/saleor/saleor/commit/cdb66da97abb7c86939e384914cd8d9194f378e8Patch
• https://github.com/saleor/saleor/commit/d6a94e95bd77f3f733fa66afd1b1ac72e863ca2aPatch
• https://github.com/saleor/saleor/commit/e42aa4d6e588982e78942b033af051c8ec8f43faPatch
• https://github.com/saleor/saleor/commit/f0371bdd4cafcc841f1a9e7049cead6133bf7464Patch
• https://github.com/saleor/saleor/security/advisories/GHSA-24jw-f244-qfppPatch, Vendor Advisory

Published

Apr 8, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33750The brace-expansion library generates arbitrary strings cont…7.5
• CVE-2026-33751n8n is an open source workflow automation platform. Prior to…4.8
• CVE-2026-33752curl_cffi is the a Python binding for curl. Prior to 0.15.0,…8.6
• CVE-2026-33753rfc3161-client is a Python library implementing the Time-Sta…7.5
• CVE-2026-33754Wazuh is a free and open source platform used for threat pre…6.5
• CVE-2026-33755Group-Office is an enterprise customer relationship manageme…8.8
• CVE-2026-33757OpenBao is an open source identity-based secrets management …8.3
• CVE-2026-33758OpenBao is an open source identity-based secrets management …6.1
• CVE-2026-33759WWBN AVideo is an open source video platform. In versions up…5.3
• CVE-2026-3376A security vulnerability has been detected in Tenda F453 1.0…8.8
• CVE-2026-33760Langflow is a tool for building and deploying AI-powered age…8.8
• CVE-2026-33761WWBN AVideo is an open source video platform. In versions up…5.3