CVE-2026-27610: 
JavaScript vulnerability analysis and mitigation

CVE-2026-27610 is a cache key collision vulnerability in Parse Dashboard (npm package parse-dashboard) that can leak the full master key to read-only sessions or vice versa under specific timing conditions. It affects versions 7.3.0-alpha.42 through 9.0.0-alpha.7 (Node.js) and was published on February 23, 2026, with a fix released in version 9.0.0-alpha.8. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 7.0 (High) (Github Advisory, Parse Dashboard Advisory).

The root cause is classified as CWE-1289 (Improper Validation of Unsafe Equivalence in Input). The ConfigKeyCache component uses the same cache key string ('masterKey') for both the full master key and the read-only master key when resolving function-typed configuration keys, creating a cache key collision. Under race or timing conditions — for example, when a read-only user's request is processed shortly after a privileged user's request populates the cache — the wrong cached key value is returned to the requesting session. The fix, committed in f92a9ef, introduces distinct cache keys ('masterKey' vs. 'readOnlyMasterKey') based on the matchingAccess.readOnly flag, and also adds proper authentication middleware and CSRF protection to the AI Agent endpoint (Parse Dashboard Advisory, Fix Commit).

Successful exploitation allows a read-only user to obtain the full master key, enabling them to perform unrestricted administrative operations on the Parse Server backend — including reading, writing, and deleting any data. Conversely, a privileged user could receive the read-only master key, potentially disrupting expected write operations. The primary risk is unauthorized privilege escalation, which could expose sensitive application data, allow modification of backend records, and undermine the integrity of access controls across all apps managed by the affected Parse Dashboard instance (Github Advisory, Parse Dashboard Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability requires low privileges (a valid dashboard account), network access, and specific timing conditions (high attack complexity with attack requirements present), making opportunistic exploitation difficult. The EPSS score is approximately 0.024% (7th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and no threat actor attribution has been reported (Github Advisory).

1. Reconnaissance: Identify a Parse Dashboard instance (versions 7.3.0-alpha.42 through 9.0.0-alpha.7) that uses function-typed master keys and has the agent configuration block enabled.
2. Obtain read-only credentials: Acquire or register a read-only dashboard user account for the target Parse Dashboard instance.
3. Time concurrent requests: Arrange for a privileged user's request (or simulate one) to populate the ConfigKeyCache with the full master key under the generic 'masterKey' cache key.
4. Send read-only request during cache window: Immediately send an authenticated request as the read-only user to an endpoint that resolves the master key via ConfigKeyCache.get() (e.g., the AI Agent endpoint /apps/:appId/agent). Due to the cache key collision, the read-only session may receive the cached full master key.
5. Use leaked master key: Use the obtained full master key to make direct Parse Server API calls with administrative privileges, bypassing read-only restrictions to read, write, or delete data (Parse Dashboard Advisory, Fix Commit).

• Logs: Parse Dashboard access logs showing read-only user accounts making requests to the /apps/:appId/agent endpoint followed by unexpected write or administrative API calls to Parse Server.
• Logs: Anomalous Parse Server API requests authenticated with the full master key originating from sessions or IP addresses associated with read-only dashboard users.
• Network: Outbound Parse Server API calls (e.g., to port 1337 or configured Parse Server port) from read-only user sessions performing write operations (POST/PUT/DELETE) that should be restricted.
• Application Behavior: Read-only users successfully performing data modification or deletion operations in the Parse Dashboard or directly against the Parse Server REST API.

Upgrade Parse Dashboard to version 9.0.0-alpha.8 or later, which introduces distinct cache keys for master key and read-only master key, eliminating the collision (Release Notes). If immediate upgrade is not possible, two workarounds are available: (1) avoid using function-typed master keys in your dashboard configuration, or (2) remove the agent configuration block entirely from your dashboard configuration. Both workarounds prevent the vulnerable code path from being triggered (Parse Dashboard Advisory).