Parse Dashboard Has a Cache Key Collision that Leaks Master Key to Read-Only Sessions

中 5.3CVE-2026-27610 · GHSA-jhp4-jvq3-w5xr · 25/02/2026 公開 · 26/06/2026 更新

要点

CVE-2026-27610 は parse dashboard (parseplatform), parse-dashboard に影響する深刻度「中」 (CVSS 5.3) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.38%（全脆弱性の 32.4% より高い）。
対処：9.0.0-alpha.8 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
parse dashboard parseplatform	`= 7.3.0= 7.4.0= 7.5.0= 7.6.0= 8.0.0= 8.1.0= 8.1.1= 8.2.0= 8.3.0= 8.4.0= 8.4.1= 8.5.0= 9.0.0`	修正版なし
parse-dashboard npm	`≥ 7.3.0-alpha.42, < 9.0.0-alpha.8`	`9.0.0-alpha.8`

概要

Impact

The ConfigKeyCache uses the same cache key for both master key and read-only master key when resolving function-typed keys. Under specific timing conditions, a read-only user can receive the cached full master key, or a regular user can receive the cached read-only master key.

Patches

The fix uses distinct cache keys for master key and read-only master key.

Workarounds

Avoid using function-typed master keys, or remove the agent configuration block from your dashboard configuration.

Resources

NVD の説明

Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the `ConfigKeyCache` uses the same cache key for both master key and read-only master key when resolving function-typed keys. Under specific timing conditions, a read-only user can receive the cached full master key, or a regular user can receive the cached read-only master key. The fix in version 9.0.0-alpha.8 uses distinct cache keys for master key and read-only master key. As a workaround, avoid using function-typed master keys, or remove the `agent` configuration block from your dashboard configuration.