CVE-2026-30854: Parse Server GraphQL Introspection Bypass Vulnerability
Summary
CVE-2026-30854: Impact When graphQLPublicIntrospection is disabled, type queries nested inside inline fragments (e.g. Affects parse-server versions >= 9.3.1-alpha.3, < 9.5.0-alpha.10. Fixed in 9.5.0-alpha.10. How to fix ↓
Also tracked for
- parse · Bitnami
The same CVE-2026-30854 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Parse Server is an open-source backend framework that enables developers to build applications with a robust cloud-based infrastructure. It provides features like data storage, user management, and real-time notifications. However, a recent vulnerability has been identified in its GraphQL implementation, specifically related to the handling of introspection queries when public introspection is disabled.
Vulnerability Detail
The vulnerability arises from the ability of unauthenticated users to bypass the introspection control for __type queries nested within inline fragments. This allows attackers to perform type reconnaissance on the GraphQL schema, potentially exposing sensitive information about the data structure. The issue is particularly concerning as it can lead to unauthorized access to metadata about the API, which could be exploited in further attacks.
How To Fix
Latest published version: 9.10.5 as of 22 Oct 2026
npm install parse-server@9.10.5Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
9.5.0-alpha.10
This is the first release that contains the fix.
npm install parse-server@9.5.0-alpha.10Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As an immediate workaround, you can require master key authentication at the network layer, such as through a reverse proxy, for the GraphQL endpoint. This will help mitigate the risk of unauthorized introspection queries until the package can be updated.
Conclusion
In summary, the CVE-2026-30854 vulnerability in Parse Server allows for a bypass of GraphQL introspection controls, posing a risk to applications using this framework. It is crucial to update to the patched version to mitigate this risk, and immediate workarounds should be implemented to protect sensitive data.
See every vulnerability recorded for parse-server →
FAQ
The vulnerability allows unauthenticated users to bypass GraphQL introspection controls, enabling them to query the schema and gain insights into the data structure.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your package-lock.json for vulnerabilities.
If exploited, this vulnerability could lead to unauthorized access to sensitive schema information, which could facilitate further attacks on the application.
Yes, updating to Parse Server version 9.5.0-alpha.10 or later provides a permanent fix for this vulnerability.
The CVSS score of this vulnerability is 6.9, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for parse-server.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
