CVE-2026-35401

Saleor is an e-commerce platform. From 2.0.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, a malicious actor can include many GraphQL mutations or queries in a single API call using aliases or chaining multiple mutations, resulting in resource exhaustion. This vulnerability is fixed in 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118.

• CWE-770

• https://github.com/saleor/saleor/security/advisories/GHSA-gqqv-xwx3-jj4hPatch, Vendor Advisory

Published

Apr 8, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-35396WeGIA is a Web manager for charitable institutions. Prior to…6.1
• CVE-2026-35397Jupyter Server is the backend for Jupyter web applications. …8.8
• CVE-2026-35398WeGIA is a Web manager for charitable institutions. Prior to…6.1
• CVE-2026-35399WeGIA is a Web manager for charitable institutions. Prior to…6.1
• CVE-2026-3540Inappropriate implementation in WebAudio in Google Chrome pr…8.8
• CVE-2026-35400LORIS (Longitudinal Online Research and Imaging System) is a…4.3
• CVE-2026-35402mcp-neo4j-cypher is an MCP server for executing Cypher queri…2.3
• CVE-2026-35403LORIS (Longitudinal Online Research and Imaging System) is a…5.4
• CVE-2026-35404Open edX Platform enables the authoring and delivery of onli…6.1
• CVE-2026-35405libp2p-rust is the official rust language Implementation of …7.5
• CVE-2026-35406Aardvark-dns is an authoritative dns server for A/AAAA conta…7.5
• CVE-2026-35407Saleor is an e-commerce platform. From 2.10.0 to before 3.23…6.5