CVE-2026-109302
3.7LowPublished 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-863
Impact
Unauthenticated attackers with public client credentials can view the full GraphQL schema, exposing private class and field names. They need network access to GraphQL and must replay an introspection query previously cached by an administrative client.
Root cause
GraphQL introspection restrictions only inspect direct query text, failing to validate queries resolved from Apollo Server's automatic persisted query cache.
Affected systems
Parse Server 8.2.2 before 8.6.94, and 9.0.0 before 9.10.1-alpha.14
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Fix & remediation
Upgrade Parse Server to 8.6.94, 9.10.1-alpha.14, or higher. If patching must wait, disable Apollo Server automatic persisted queries or clear and restrict cached introspection queries.
$ npm install parse-server@^8.6.94AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 applies its GraphQL introspection control only to operation text sent directly with a request, not to operations resolved from Apollo Server's automatic persisted query cache. Unauthenticated attackers holding the public Application Id and client key can replay an introspection query previously cached by a master or maintenance key client to retrieve the schema, including private class and field names.