CVE-2026-109302 Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 GraphQL Schema Disclosure via Persisted Queries
Unauthenticated attackers can retrieve the GraphQL schema, including private class and field names, by replaying cached introspection queries.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-109302?
CVE-2026-109302 is a medium-severity vulnerability in parse-community parse-server, published on 12 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 applies its GraphQL introspection control only to operation text sent directly with a request, not to operations resolved from Apollo Server's automatic persisted query cache. Unauthenticated attackers holding the public Application Id and client key can replay an introspection query previously cached by a master or maintenance key client to retrieve the schema, including private class and field names.
Weakness: CWE-863
Which versions are affected by CVE-2026-109302?
1 open source package ship an affected version, including parse.
| Package | Affected | Fixed in |
|---|---|---|
parse Bitnami | From 8.2.2 | 8.6.94, 9.10.1 |
How do I fix CVE-2026-109302?
Upgrade parse to a fixed version for your release line: 8.6.94 or 9.10.1.
Is CVE-2026-109302 being exploited?
There is no known exploitation of CVE-2026-109302 in the wild and no public exploit code.
Sources
Also known as BIT-parse-2026-109302, GHSA-5rwh-p68m-8595, GHSA-gxxq-pghq-9vrc.