CVE-2026-66009 Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages
Attackers can discover custom field names via GraphQL errors despite disabled introspection, exposing schema details.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-66009?
CVE-2026-66009 is a medium-severity vulnerability in parse-community parse-server, published on 24 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Parse Server versions >= 9.0.0 before 9.10.0-alpha.5 and >= 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled (graphQLPublicIntrospection: false, the default). A client holding only the public application id — with no user session, master key, or maintenance key — can trigger validation errors to learn the names of required (non-null) custom fields on classes it already references by name, partially defeating the schema-hiding intent of disabling public introspection. No stored data, credentials, optional field names, unreferenced class names, or Cloud Code function names are exposed.
Weakness: CWE-209
Which versions are affected by CVE-2026-66009?
1 open source package ship an affected version, including parse.
| Package | Affected | Fixed in |
|---|---|---|
parse Bitnami | From 8.2.2 | 8.6.86, 9.10.0 |
How do I fix CVE-2026-66009?
Upgrade parse to a fixed version for your release line: 8.6.86 or 9.10.0.
Is CVE-2026-66009 being exploited?
There is no known exploitation of CVE-2026-66009 in the wild and no public exploit code.
Sources
Also known as BIT-parse-2026-66009, GHSA-2fgh-8j2g-w354, GHSA-v9g2-r7jf-7j84.