CVE-2026-27610 Parse Dashboard Has a Cache Key Collision that Leaks Master Key to Read-Only Sessions
A cache key collision in Parse Dashboard allows read-only users to potentially access the full master key, leading to unauthorized data access and privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-27610?
CVE-2026-27610 is a high-severity vulnerability in parse-community parse-dashboard, published on 25 Feb 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the `ConfigKeyCache` uses the same cache key for both master key and read-only master key when resolving function-typed keys. Under specific timing conditions, a read-only user can receive the cached full master key, or a regular user can receive the cached read-only master key. The fix in version 9.0.0-alpha.8 uses distinct cache keys for master key and read-only master key. As a workaround, avoid using function-typed master keys, or remove the `agent` configuration block from your dashboard configuration.
Weakness: CWE-1289
Which versions are affected by CVE-2026-27610?
2 open source packages ship an affected version, including parse-dashboard. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
parse-dashboard npm | From 7.3.0-alpha.42 | 9.0.0-alpha.8 |
parse-dashboard npm | From 7.3.0-alpha.42 | 9.0.0-alpha.8 |
Products include Parseplatform Parse Dashboard.
How do I fix CVE-2026-27610?
Upgrade parse-dashboard to 9.0.0-alpha.8 or later.
Is CVE-2026-27610 being exploited?
There is no known exploitation of CVE-2026-27610 in the wild and no public exploit code.
Other vulnerabilities in parse-community parse-dashboard
Sources
Also known as GHSA-jhp4-jvq3-w5xr.