CVE-2026-109302: Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 GraphQL Schema Disclosure via Persisted Queries
Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 applies its GraphQL introspection control only to operation text sent directly with a request, not to operations resolved from Apollo Server's automatic persisted query cache. Unauthenticated attackers holding the public Application Id and client key can replay an introspection query previously cached by a master or maintenance key client to retrieve the schema, including private class and field names.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Parse Serverto a version that resolves this vulnerability.Fixed in 8.6.94 - Upgrade
Upgrade
Parse Serverto a version that resolves this vulnerability.Fixed in 9.10.1-alpha.14
Event History
Frequently Asked Questions
Which deployments are exposed to unauthenticated schema disclosure?
Deployments in the affected version ranges are exposed if Apollo Server's automatic persisted query cache contains an introspection operation that was previously submitted by a client using a master or maintenance key. The attacker also needs the public Application Id and client key.
Does disabling GraphQL introspection prevent this issue?
Not by itself. The affected behavior enforces the introspection control for operation text sent directly in a request, but not for an introspection operation resolved from the automatic persisted query cache.
What information can an attacker obtain?
An attacker can retrieve the GraphQL schema, including private class names and field names. The provided information does not indicate direct access to the underlying records or modification capabilities.
What should be prioritized if an immediate upgrade is not possible?
Prioritize preventing unauthenticated replay of cached introspection queries and assess whether a master- or maintenance-key client has populated the automatic persisted query cache with introspection operations. The provided data does not specify a documented workaround or cache-clearing procedure.