CVE-2026-30854: 
JavaScript vulnerability analysis and mitigation

CVE-2026-30854 is a GraphQL __type introspection bypass vulnerability in Parse Server, an open-source Node.js backend platform. When the graphQLPublicIntrospection setting is disabled, __type queries nested inside inline fragments (e.g., ... on Query { __type(name:"User") { name } }) bypass the introspection control, allowing unauthenticated users to perform type reconnaissance against the GraphQL schema. The vulnerability affects Parse Server versions from 9.3.1-alpha.3 up to (but not including) 9.5.0-alpha.10. It was disclosed on March 7, 2026, and carries a CVSS v4 base score of 6.9 (Medium) and a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, Github Advisory).

The root cause is an incorrect authorization check (CWE-863) in Parse Server's GraphQL introspection enforcement logic. The original implementation performed only a flat iteration over root-level selections in a GraphQL query to detect and block __type introspection calls; it did not recursively walk nested selection sets, such as those inside inline fragments. An attacker can exploit this by wrapping a __type query inside an inline fragment (e.g., ... on Query { __type(name:"User") { name } }), which evades the flat check and returns type metadata to the unauthenticated caller. The fix involved changing the check to a recursive walk of all selection sets, detecting __type at any nesting depth (GitHub Advisory). Note that __schema introspection is not affected by this bypass.

Successful exploitation allows unauthenticated attackers to enumerate GraphQL type information — including field names, object relationships, and data structure details — that should be protected by the graphQLPublicIntrospection=disabled configuration. This is primarily an information disclosure issue with low confidentiality impact and no integrity or availability impact. However, the exposed schema details can facilitate more targeted follow-on attacks by enabling attackers to map the application's data model and identify exploitable fields or endpoints (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability requires no authentication, no user interaction, and no special preconditions beyond network access to the GraphQL endpoint, making it trivially exploitable by any unauthenticated attacker. The EPSS score is approximately 0.019% (5th percentile), indicating a low near-term exploitation probability (Github Advisory). The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported.

1. Reconnaissance: Identify internet-facing Parse Server instances running versions 9.3.1-alpha.3 through 9.5.0-alpha.9 with a GraphQL endpoint exposed (typically at /graphql). Tools like Shodan or Censys can be used to locate such endpoints.
2. Confirm GraphQL endpoint: Send a basic GraphQL POST request to the /graphql endpoint to confirm it is active and responding.
3. Craft inline fragment payload: Construct a GraphQL query that wraps a __type introspection call inside an inline fragment to bypass the flat introspection check, for example:

query {
  ... on Query {
    __type(name: "User") {
      name
      fields {
        name
        type {
          name
          kind
        }
      }
    }
  }
}

4. Send the request: Submit the crafted query as an unauthenticated HTTP POST request to the GraphQL endpoint with Content-Type: application/json.
5. Enumerate schema types: Repeat the query with different type names (e.g., "Role", "Session", "_User") to map out the full data model, field names, and object relationships for use in further targeted attacks (GitHub Advisory).

• Network: Unusual HTTP POST requests to the /graphql endpoint from unauthenticated sources containing inline fragment syntax (... on Query) combined with __type field references; high volume of GraphQL requests enumerating different type names.
• Logs: Parse Server access logs showing repeated unauthenticated GraphQL POST requests with query bodies containing __type nested inside ... on Query { } inline fragments; requests cycling through multiple type names (e.g., User, Role, Session) in rapid succession.
• Application Behavior: GraphQL responses returning type metadata (field names, kinds, types) to unauthenticated callers despite graphQLPublicIntrospection being set to false (GitHub Advisory).

Upgrade Parse Server to version 9.5.0-alpha.10 or later, which fixes the vulnerability by replacing the flat root-level selection check with a recursive walk of all selection sets (GitHub Advisory). As an interim workaround for organizations unable to patch immediately, require master key authentication at the network layer (e.g., via a reverse proxy) for the GraphQL endpoint to prevent unauthenticated access. Additionally, consider deploying WAF rules to detect and block GraphQL queries containing __type inside inline fragments, and monitor GraphQL query logs for suspicious introspection patterns (Feedly).

The advisory was published by Parse Server maintainer mtrezza on March 7, 2026, with credit to reporter fancymalware for discovering the bypass (GitHub Advisory). The vulnerability received standard automated tracking coverage from vulnerability aggregators and feeds shortly after disclosure, with no notable broader media coverage or significant community debate identified.