CVE-2026-27595: Parse Dashboard Incomplete Authentication on AI Agent Endpoint
Summary
CVE-2026-27595: Parse Dashboard has incomplete authentication on AI Agent endpoint. Affects parse-dashboard versions >= 7.3.0-alpha.42, < 9.0.0-alpha.8. Fixed in 9.0.0-alpha.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Parse Dashboard is an open-source web application that provides a user-friendly interface for managing and monitoring Parse Server applications. It allows developers to visualize data, manage users, and perform various administrative tasks. However, a critical vulnerability has been identified in the AI Agent API endpoint, which lacks proper authentication, exposing connected Parse Servers to potential unauthorized access.
Vulnerability Detail
The vulnerability arises from the AI Agent API endpoint (POST /apps/:appId/agent) not requiring authentication. This oversight allows unauthenticated remote attackers to send requests to the endpoint, enabling them to perform arbitrary database operations against any connected Parse Server using the master key. The implications of this vulnerability are severe, as it could lead to unauthorized data access, manipulation, or even complete compromise of the database.
How To Fix
Latest published version: 9.2.0 as of 23 Oct 2026
npm install parse-dashboard@9.2.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
9.0.0-alpha.8
This is the first release that contains the fix.
npm install parse-dashboard@9.0.0-alpha.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can remove the agent configuration block from your dashboard configuration. Dashboards without an agent config are not affected by this vulnerability. Here is an example of how to remove the agent configuration:
{
"apps": [
{
"appId": "YOUR_APP_ID",
"serverURL": "YOUR_SERVER_URL"
// Remove the agent configuration block
}
]
}
Conclusion
In summary, the CVE-2026-27595 vulnerability in Parse Dashboard poses a critical risk due to incomplete authentication on the AI Agent endpoint. It is crucial to update to the patched version or implement the provided workaround to safeguard your application from potential attacks.
See every vulnerability recorded for parse-dashboard →
FAQ
The CVSS score of this vulnerability is 9.9, indicating a critical level of severity.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The potential consequences include unauthorized access to sensitive data, manipulation of database records, and complete compromise of the connected Parse Server.
Yes, you can temporarily secure the endpoint by removing the agent configuration block from your dashboard configuration.
Parse Dashboard is used for managing and monitoring Parse Server applications, allowing developers to visualize data and perform administrative tasks.
References
Related vulnerabilities
Recent vulnerabilities recorded for parse-dashboard.
