CVE-2026-27610highCWE-1289

CVE-2026-27610: high-severity vulnerability in parse-community parse-dashboard

Parse Dashboard Has a Cache Key Collision that Leaks Master Key to Read-Only Sessions

Published · Updated

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7epss 0.4%
exploitation probability
0.4%top 67% of all CVEs
observed exploitation
nono source reports it
In short

Parse Dashboard has a flaw where its cache system uses the same key for both full and read-only master keys, allowing a read-only user to accidentally receive the full master key under certain timing conditions. This compromises security by giving unauthorized access to sensitive administrative credentials.

Technical detail

The ConfigKeyCache in Parse Dashboard versions 7.3.0-alpha.42 through 9.0.0-alpha.7 fails to differentiate cache keys when resolving function-typed master keys, creating a collision vulnerability. Under race conditions, cache lookups can return the wrong credential type (master key instead of read-only key or vice versa), allowing privilege escalation and unauthorized administrative access.

Summary generated and translated by AI from the official description.
Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the `ConfigKeyCache` uses the same cache key for both master key and read-only master key when resolving function-typed keys. Under specific timing conditions, a read-only user can receive the cached full master key, or a regular user can receive the cached read-only master key. The fix in version 9.0.0-alpha.8 uses distinct cache keys for master key and read-only master key. As a workaround, avoid using function-typed master keys, or remove the `agent` configuration block from your dashboard configuration.
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N
Affected products
parse-community · parse-dashboard
Related CVEs — parse-community parse-dashboard

In the same product, most dangerous first.

CVE-2026-27595CRITICALParse Dashboard has incomplete authentication on AI Agent endpointEPSS 0.6%CVE-2026-27608CRITICALParse Dashboard Missing Authorization on Agent EndpointEPSS 0.4%CVE-2026-27609HIGHParse Dashboard Missing CSRF Protection on Agent EndpointEPSS 0.2%
References
https://github.com/parse-community/parse-dashboard/commit/f92a9ef5246d57e51696bd881a15f3b133b2bb50https://github.com/parse-community/parse-dashboard/releases/tag/9.0.0-alpha.8https://github.com/parse-community/parse-dashboard/security/advisories/GHSA-jhp4-jvq3-w5xr