Parse Dashboard Has a Cache Key Collision that Leaks Master Key to Read-Only Sessions

TRUNG BÌNH 5.3CVE-2026-27610 · GHSA-jhp4-jvq3-w5xr · Công bố 25/02/2026 · cập nhật 26/06/2026

Tóm tắt nhanh

CVE-2026-27610 là lỗ hổng mức TRUNG BÌNH (CVSS 5.3) ảnh hưởng parse dashboard (parseplatform), parse-dashboard.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.38%, cao hơn 32.4% các lỗ hổng khác.
Cách xử lý: cập nhật lên 9.0.0-alpha.8 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
parse dashboard parseplatform	`= 7.3.0= 7.4.0= 7.5.0= 7.6.0= 8.0.0= 8.1.0= 8.1.1= 8.2.0= 8.3.0= 8.4.0= 8.4.1= 8.5.0= 9.0.0`	Chưa có bản vá
parse-dashboard npm	`≥ 7.3.0-alpha.42, < 9.0.0-alpha.8`	`9.0.0-alpha.8`

Mô tả

Impact

The ConfigKeyCache uses the same cache key for both master key and read-only master key when resolving function-typed keys. Under specific timing conditions, a read-only user can receive the cached full master key, or a regular user can receive the cached read-only master key.

Patches

The fix uses distinct cache keys for master key and read-only master key.

Workarounds

Avoid using function-typed master keys, or remove the agent configuration block from your dashboard configuration.

Resources

Mô tả của NVD

Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the `ConfigKeyCache` uses the same cache key for both master key and read-only master key when resolving function-typed keys. Under specific timing conditions, a read-only user can receive the cached full master key, or a regular user can receive the cached read-only master key. The fix in version 9.0.0-alpha.8 uses distinct cache keys for master key and read-only master key. As a workaround, avoid using function-typed master keys, or remove the `agent` configuration block from your dashboard configuration.