Skip to content
AI Sec Watch
CriticalVulnerability

CVE-2026-27595: Parse Dashboard unauthenticated access to database via AI Agent API endpoint

Source
NVD(opens in a new tab)
Identifier
CVE-2026-27595
Published
Record updated
View JSON
Affected
  • parse-dashboard >= 7.3.0-alpha.42, < 9.0.0-alpha.8
Fixed in
9.0.0-alpha.8
  • released February 19, 2026, 6 days before disclosure
Known exploitation
Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
EPSS
0.5%

Summary

Parse Dashboard versions 7.3.0-alpha.42 through 9.0.0-alpha.7 expose an AI Agent API endpoint, POST `/apps/:appId/agent`, that contains multiple chained security vulnerabilities. Unauthenticated remote attackers can use them to perform arbitrary read and write operations against any connected Parse Server database with the master key. The agent feature is opt-in, so dashboards without an agent config are not affected.

Mitigation

Fixed in 9.0.0-alpha.8, which adds authentication, CSRF validation, and per-app authorization middleware to the agent endpoint, restricts read-only users to the `readOnlyMasterKey` with write permissions stripped server-side, and corrects a cache key collision between master key and read-only master key. Workaround: remove or comment out the agent configuration block from your Parse Dashboard configuration.

Related items