CVE-2026-27610

Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the `ConfigKeyCache` uses the same cache key for both master key and read-only master key when resolving function-typed keys. Under specific timing conditions, a read-only user can receive the cached full master key, or a regular user can receive the cached read-only master key. The fix in version 9.0.0-alpha.8 uses distinct cache keys for master key and read-only master key. As a workaround, avoid using function-typed master keys, or remove the `agent` configuration block from your dashboard configuration.

• CWE-1289

• https://github.com/parse-community/parse-dashboard/commit/f92a9ef5246d57e51696bd881a15f3b133b2bb50Patch
• https://github.com/parse-community/parse-dashboard/releases/tag/9.0.0-alpha.8Release Notes
• https://github.com/parse-community/parse-dashboard/security/advisories/GHSA-jhp4-jvq3-w5xrVendor Advisory

Published

Feb 25, 2026

Last Modified

Jun 26, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-27605Chartbrew is an open-source web application that can connect…5.4
• CVE-2026-27606Rollup is a module bundler for JavaScript. Versions prior to…9.8
• CVE-2026-27607RustFS is a distributed object storage system built in Rust.…9.1
• CVE-2026-27608Parse Dashboard is a standalone dashboard for managing Parse…8.1
• CVE-2026-27609Parse Dashboard is a standalone dashboard for managing Parse…6.5
• CVE-2026-2761Sandbox escape in the Graphics: WebRender component. This vu…10
• CVE-2026-27611FileBrowser Quantum is a free, self-hosted, web-based file m…6.5
• CVE-2026-27612Repostat is a React component to fetch and display GitHub re…6.1
• CVE-2026-27613TinyWeb is a web server (HTTP, HTTPS) written in Delphi for …9.8
• CVE-2026-27614Bugsink is a self-hosted error tracking tool. In versions pr…6.1
• CVE-2026-27615ADB Explorer is a fluent UI for ADB on Windows. In versions …7.8
• CVE-2026-27616Vikunja is an open-source self-hosted task management platfo…7.3