CVE-2026-27609: Parse Dashboard Missing CSRF Protection on Agent Endpoint

Published Feb 25, 2026
·
Updated

Impact

The AI Agent API endpoint (POST /apps/:appId/agent) lacks CSRF protection. An attacker can craft a malicious page that, when visited by an authenticated dashboard user, submits requests to the agent endpoint using the victim's session.

Patches

The fix adds CSRF middleware to the agent endpoint and embeds a CSRF token in the dashboard page.

Workarounds

Remove the agent configuration block from your dashboard configuration. Dashboards without an agent config are not affected.

Resources

- GitHub advisory: https://github.com/parse-community/parse-dashboard/security/advisories/GHSA-3534-xp88-25rc - Fixed in: https://github.com/parse-community/parse-dashboard/releases/tag/9.0.0-alpha.8

Other sources

Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the AI Agent API endpoint (POST /apps/:appId/agent) lacks CSRF protection. An attacker can craft a malicious page that, when visited by an authenticated dashboard user, submits requests to the agent endpoint using the victim's session. The fix in version 9.0.0-alpha.8 adds CSRF middleware to the agent endpoint and embeds a CSRF token in the dashboard page. As a workaround, remove the agent configuration block from your dashboard configuration. Dashboards without an agent config are not affected.

— MITRE

Affected Software

273 affected componentsFixes available
npm/parse-dashboard>=7.3.0-alpha.42<=9.0.0-alpha.7
npm/parse-dashboard>=7.3.0-alpha.42<9.0.0-alpha.8
9.0.0-alpha.8
parseplatform Parse Dashboard Node.js=7.3.0-alpha.42
parseplatform Parse Dashboard Node.js=7.3.0-alpha.43
parseplatform Parse Dashboard Node.js=7.3.0-alpha.44
parseplatform Parse Dashboard Node.js=7.3.0-alpha.5
parseplatform Parse Dashboard Node.js=7.3.0-alpha.6
parseplatform Parse Dashboard Node.js=7.3.0-alpha.7
parseplatform Parse Dashboard Node.js=7.3.0-alpha.8
parseplatform Parse Dashboard Node.js=7.3.0-alpha.9
parseplatform Parse Dashboard Node.js=7.3.0-alpha.42
parseplatform Parse Dashboard Node.js=7.4.0-alpha.1
parseplatform Parse Dashboard Node.js=7.4.0-alpha.2
parseplatform Parse Dashboard Node.js=7.4.0-alpha.3
parseplatform Parse Dashboard Node.js=7.4.0-alpha.4
parseplatform Parse Dashboard Node.js=7.4.0-alpha.5
parseplatform Parse Dashboard Node.js=7.5.0-alpha.1
parseplatform Parse Dashboard Node.js=7.5.0-alpha.2
parseplatform Parse Dashboard Node.js=7.6.0-alpha.1
parseplatform Parse Dashboard Node.js=7.6.0-alpha.10
parseplatform Parse Dashboard Node.js=7.6.0-alpha.11
parseplatform Parse Dashboard Node.js=7.6.0-alpha.12
parseplatform Parse Dashboard Node.js=7.6.0-alpha.13
parseplatform Parse Dashboard Node.js=7.6.0-alpha.2
parseplatform Parse Dashboard Node.js=7.6.0-alpha.3
parseplatform Parse Dashboard Node.js=7.6.0-alpha.4
parseplatform Parse Dashboard Node.js=7.6.0-alpha.5
parseplatform Parse Dashboard Node.js=7.6.0-alpha.6
parseplatform Parse Dashboard Node.js=7.6.0-alpha.7
parseplatform Parse Dashboard Node.js=7.6.0-alpha.8
parseplatform Parse Dashboard Node.js=7.6.0-alpha.9
parseplatform Parse Dashboard Node.js=8.0.0-alpha.1
parseplatform Parse Dashboard Node.js=8.0.0-alpha.2
parseplatform Parse Dashboard Node.js=8.0.0-alpha.3
parseplatform Parse Dashboard Node.js=8.0.0-alpha.4
parseplatform Parse Dashboard Node.js=8.0.0-alpha.5
parseplatform Parse Dashboard Node.js=8.0.0-alpha.6
parseplatform Parse Dashboard Node.js=8.1.0-alpha.1
parseplatform Parse Dashboard Node.js=8.1.0-alpha.10
parseplatform Parse Dashboard Node.js=8.1.0-alpha.11
parseplatform Parse Dashboard Node.js=8.1.0-alpha.12
parseplatform Parse Dashboard Node.js=8.1.0-alpha.13
parseplatform Parse Dashboard Node.js=8.1.0-alpha.2
parseplatform Parse Dashboard Node.js=8.1.0-alpha.3
parseplatform Parse Dashboard Node.js=8.1.0-alpha.4
parseplatform Parse Dashboard Node.js=8.1.0-alpha.5
parseplatform Parse Dashboard Node.js=8.1.0-alpha.6
parseplatform Parse Dashboard Node.js=8.1.0-alpha.7
parseplatform Parse Dashboard Node.js=8.1.0-alpha.8
parseplatform Parse Dashboard Node.js=8.1.0-alpha.9
parseplatform Parse Dashboard Node.js=8.1.1-alpha.1
parseplatform Parse Dashboard Node.js=8.2.0-alpha.1
parseplatform Parse Dashboard Node.js=8.2.0-alpha.10
parseplatform Parse Dashboard Node.js=8.2.0-alpha.11
parseplatform Parse Dashboard Node.js=8.2.0-alpha.12
parseplatform Parse Dashboard Node.js=8.2.0-alpha.13
parseplatform Parse Dashboard Node.js=8.2.0-alpha.14
parseplatform Parse Dashboard Node.js=8.2.0-alpha.15
parseplatform Parse Dashboard Node.js=8.2.0-alpha.16
parseplatform Parse Dashboard Node.js=8.2.0-alpha.17
parseplatform Parse Dashboard Node.js=8.2.0-alpha.18
parseplatform Parse Dashboard Node.js=8.2.0-alpha.19
parseplatform Parse Dashboard Node.js=8.2.0-alpha.2
parseplatform Parse Dashboard Node.js=8.2.0-alpha.20
parseplatform Parse Dashboard Node.js=8.2.0-alpha.21
parseplatform Parse Dashboard Node.js=8.2.0-alpha.22
parseplatform Parse Dashboard Node.js=8.2.0-alpha.23
parseplatform Parse Dashboard Node.js=8.2.0-alpha.24
parseplatform Parse Dashboard Node.js=8.2.0-alpha.25
parseplatform Parse Dashboard Node.js=8.2.0-alpha.26
parseplatform Parse Dashboard Node.js=8.2.0-alpha.27
parseplatform Parse Dashboard Node.js=8.2.0-alpha.3
parseplatform Parse Dashboard Node.js=8.2.0-alpha.4
parseplatform Parse Dashboard Node.js=8.2.0-alpha.5
parseplatform Parse Dashboard Node.js=8.2.0-alpha.6
parseplatform Parse Dashboard Node.js=8.2.0-alpha.7
parseplatform Parse Dashboard Node.js=8.2.0-alpha.8
parseplatform Parse Dashboard Node.js=8.2.0-alpha.9
parseplatform Parse Dashboard Node.js=8.3.0-alpha.1
parseplatform Parse Dashboard Node.js=8.3.0-alpha.10
parseplatform Parse Dashboard Node.js=8.3.0-alpha.11
parseplatform Parse Dashboard Node.js=8.3.0-alpha.12
parseplatform Parse Dashboard Node.js=8.3.0-alpha.13
parseplatform Parse Dashboard Node.js=8.3.0-alpha.14
parseplatform Parse Dashboard Node.js=8.3.0-alpha.15
parseplatform Parse Dashboard Node.js=8.3.0-alpha.16
parseplatform Parse Dashboard Node.js=8.3.0-alpha.17
parseplatform Parse Dashboard Node.js=8.3.0-alpha.18
parseplatform Parse Dashboard Node.js=8.3.0-alpha.19
parseplatform Parse Dashboard Node.js=8.3.0-alpha.2
parseplatform Parse Dashboard Node.js=8.3.0-alpha.20
parseplatform Parse Dashboard Node.js=8.3.0-alpha.21
parseplatform Parse Dashboard Node.js=8.3.0-alpha.22
parseplatform Parse Dashboard Node.js=8.3.0-alpha.23
parseplatform Parse Dashboard Node.js=8.3.0-alpha.24
parseplatform Parse Dashboard Node.js=8.3.0-alpha.25
parseplatform Parse Dashboard Node.js=8.3.0-alpha.26
parseplatform Parse Dashboard Node.js=8.3.0-alpha.27
parseplatform Parse Dashboard Node.js=8.3.0-alpha.28
parseplatform Parse Dashboard Node.js=8.3.0-alpha.29
parseplatform Parse Dashboard Node.js=8.3.0-alpha.3
parseplatform Parse Dashboard Node.js=8.3.0-alpha.30
parseplatform Parse Dashboard Node.js=8.3.0-alpha.31
parseplatform Parse Dashboard Node.js=8.3.0-alpha.32
parseplatform Parse Dashboard Node.js=8.3.0-alpha.33
parseplatform Parse Dashboard Node.js=8.3.0-alpha.34
parseplatform Parse Dashboard Node.js=8.3.0-alpha.35
parseplatform Parse Dashboard Node.js=8.3.0-alpha.36
parseplatform Parse Dashboard Node.js=8.3.0-alpha.37
parseplatform Parse Dashboard Node.js=8.3.0-alpha.38
parseplatform Parse Dashboard Node.js=8.3.0-alpha.39
parseplatform Parse Dashboard Node.js=8.3.0-alpha.4
parseplatform Parse Dashboard Node.js=8.3.0-alpha.40
parseplatform Parse Dashboard Node.js=8.3.0-alpha.41
parseplatform Parse Dashboard Node.js=8.3.0-alpha.42
parseplatform Parse Dashboard Node.js=8.3.0-alpha.43
parseplatform Parse Dashboard Node.js=8.3.0-alpha.5
parseplatform Parse Dashboard Node.js=8.3.0-alpha.6
parseplatform Parse Dashboard Node.js=8.3.0-alpha.7
parseplatform Parse Dashboard Node.js=8.3.0-alpha.8
parseplatform Parse Dashboard Node.js=8.3.0-alpha.9
parseplatform Parse Dashboard Node.js=8.4.0-alpha.1
parseplatform Parse Dashboard Node.js=8.4.1-alpha.1
parseplatform Parse Dashboard Node.js=8.4.1-alpha.2
parseplatform Parse Dashboard Node.js=8.5.0-alpha.1
parseplatform Parse Dashboard Node.js=8.5.0-alpha.2
parseplatform Parse Dashboard Node.js=8.5.0-alpha.3
parseplatform Parse Dashboard Node.js=8.5.0-alpha.4
parseplatform Parse Dashboard Node.js=8.5.0-alpha.5
parseplatform Parse Dashboard Node.js=8.5.0-alpha.6
parseplatform Parse Dashboard Node.js=8.5.0-alpha.7
parseplatform Parse Dashboard Node.js=9.0.0-alpha.1
parseplatform Parse Dashboard Node.js=9.0.0-alpha.2
parseplatform Parse Dashboard Node.js=9.0.0-alpha.3
parseplatform Parse Dashboard Node.js=9.0.0-alpha.4
parseplatform Parse Dashboard Node.js=9.0.0-alpha.5
parseplatform Parse Dashboard Node.js=9.0.0-alpha.6
parseplatform Parse Dashboard Node.js=9.0.0-alpha.7
parseplatform Parse Dashboard Node.js=7.3.0-alpha42
parseplatform Parse Dashboard Node.js=7.3.0-alpha43
parseplatform Parse Dashboard Node.js=7.3.0-alpha44
parseplatform Parse Dashboard Node.js=7.3.0-alpha5
parseplatform Parse Dashboard Node.js=7.3.0-alpha6
parseplatform Parse Dashboard Node.js=7.3.0-alpha7
parseplatform Parse Dashboard Node.js=7.3.0-alpha8
parseplatform Parse Dashboard Node.js=7.3.0-alpha9
parseplatform Parse Dashboard Node.js=7.4.0-alpha1
parseplatform Parse Dashboard Node.js=7.4.0-alpha2
parseplatform Parse Dashboard Node.js=7.4.0-alpha3
parseplatform Parse Dashboard Node.js=7.4.0-alpha4
parseplatform Parse Dashboard Node.js=7.4.0-alpha5
parseplatform Parse Dashboard Node.js=7.5.0-alpha1
parseplatform Parse Dashboard Node.js=7.5.0-alpha2
parseplatform Parse Dashboard Node.js=7.6.0-alpha1
parseplatform Parse Dashboard Node.js=7.6.0-alpha10
parseplatform Parse Dashboard Node.js=7.6.0-alpha11
parseplatform Parse Dashboard Node.js=7.6.0-alpha12
parseplatform Parse Dashboard Node.js=7.6.0-alpha13
parseplatform Parse Dashboard Node.js=7.6.0-alpha2
parseplatform Parse Dashboard Node.js=7.6.0-alpha3
parseplatform Parse Dashboard Node.js=7.6.0-alpha4
parseplatform Parse Dashboard Node.js=7.6.0-alpha5
parseplatform Parse Dashboard Node.js=7.6.0-alpha6
parseplatform Parse Dashboard Node.js=7.6.0-alpha7
parseplatform Parse Dashboard Node.js=7.6.0-alpha8
parseplatform Parse Dashboard Node.js=7.6.0-alpha9
parseplatform Parse Dashboard Node.js=8.0.0-alpha1
parseplatform Parse Dashboard Node.js=8.0.0-alpha2
parseplatform Parse Dashboard Node.js=8.0.0-alpha3
parseplatform Parse Dashboard Node.js=8.0.0-alpha4
parseplatform Parse Dashboard Node.js=8.0.0-alpha5
parseplatform Parse Dashboard Node.js=8.0.0-alpha6
parseplatform Parse Dashboard Node.js=8.1.0-alpha1
parseplatform Parse Dashboard Node.js=8.1.0-alpha10
parseplatform Parse Dashboard Node.js=8.1.0-alpha11
parseplatform Parse Dashboard Node.js=8.1.0-alpha12
parseplatform Parse Dashboard Node.js=8.1.0-alpha13
parseplatform Parse Dashboard Node.js=8.1.0-alpha2
parseplatform Parse Dashboard Node.js=8.1.0-alpha3
parseplatform Parse Dashboard Node.js=8.1.0-alpha4
parseplatform Parse Dashboard Node.js=8.1.0-alpha5
parseplatform Parse Dashboard Node.js=8.1.0-alpha6
parseplatform Parse Dashboard Node.js=8.1.0-alpha7
parseplatform Parse Dashboard Node.js=8.1.0-alpha8
parseplatform Parse Dashboard Node.js=8.1.0-alpha9
parseplatform Parse Dashboard Node.js=8.1.1-alpha1
parseplatform Parse Dashboard Node.js=8.2.0-alpha1
parseplatform Parse Dashboard Node.js=8.2.0-alpha10
parseplatform Parse Dashboard Node.js=8.2.0-alpha11
parseplatform Parse Dashboard Node.js=8.2.0-alpha12
parseplatform Parse Dashboard Node.js=8.2.0-alpha13
parseplatform Parse Dashboard Node.js=8.2.0-alpha14
parseplatform Parse Dashboard Node.js=8.2.0-alpha15
parseplatform Parse Dashboard Node.js=8.2.0-alpha16
parseplatform Parse Dashboard Node.js=8.2.0-alpha17
parseplatform Parse Dashboard Node.js=8.2.0-alpha18
parseplatform Parse Dashboard Node.js=8.2.0-alpha19
parseplatform Parse Dashboard Node.js=8.2.0-alpha2
parseplatform Parse Dashboard Node.js=8.2.0-alpha20
parseplatform Parse Dashboard Node.js=8.2.0-alpha21
parseplatform Parse Dashboard Node.js=8.2.0-alpha22
parseplatform Parse Dashboard Node.js=8.2.0-alpha23
parseplatform Parse Dashboard Node.js=8.2.0-alpha24
parseplatform Parse Dashboard Node.js=8.2.0-alpha25
parseplatform Parse Dashboard Node.js=8.2.0-alpha26
parseplatform Parse Dashboard Node.js=8.2.0-alpha27
parseplatform Parse Dashboard Node.js=8.2.0-alpha3
parseplatform Parse Dashboard Node.js=8.2.0-alpha4
parseplatform Parse Dashboard Node.js=8.2.0-alpha5
parseplatform Parse Dashboard Node.js=8.2.0-alpha6
parseplatform Parse Dashboard Node.js=8.2.0-alpha7
parseplatform Parse Dashboard Node.js=8.2.0-alpha8
parseplatform Parse Dashboard Node.js=8.2.0-alpha9
parseplatform Parse Dashboard Node.js=8.3.0-alpha1
parseplatform Parse Dashboard Node.js=8.3.0-alpha10
parseplatform Parse Dashboard Node.js=8.3.0-alpha11
parseplatform Parse Dashboard Node.js=8.3.0-alpha12
parseplatform Parse Dashboard Node.js=8.3.0-alpha13
parseplatform Parse Dashboard Node.js=8.3.0-alpha14
parseplatform Parse Dashboard Node.js=8.3.0-alpha15
parseplatform Parse Dashboard Node.js=8.3.0-alpha16
parseplatform Parse Dashboard Node.js=8.3.0-alpha17
parseplatform Parse Dashboard Node.js=8.3.0-alpha18
parseplatform Parse Dashboard Node.js=8.3.0-alpha19
parseplatform Parse Dashboard Node.js=8.3.0-alpha2
parseplatform Parse Dashboard Node.js=8.3.0-alpha20
parseplatform Parse Dashboard Node.js=8.3.0-alpha21
parseplatform Parse Dashboard Node.js=8.3.0-alpha22
parseplatform Parse Dashboard Node.js=8.3.0-alpha23
parseplatform Parse Dashboard Node.js=8.3.0-alpha24
parseplatform Parse Dashboard Node.js=8.3.0-alpha25
parseplatform Parse Dashboard Node.js=8.3.0-alpha26
parseplatform Parse Dashboard Node.js=8.3.0-alpha27
parseplatform Parse Dashboard Node.js=8.3.0-alpha28
parseplatform Parse Dashboard Node.js=8.3.0-alpha29
parseplatform Parse Dashboard Node.js=8.3.0-alpha3
parseplatform Parse Dashboard Node.js=8.3.0-alpha30
parseplatform Parse Dashboard Node.js=8.3.0-alpha31
parseplatform Parse Dashboard Node.js=8.3.0-alpha32
parseplatform Parse Dashboard Node.js=8.3.0-alpha33
parseplatform Parse Dashboard Node.js=8.3.0-alpha34
parseplatform Parse Dashboard Node.js=8.3.0-alpha35
parseplatform Parse Dashboard Node.js=8.3.0-alpha36
parseplatform Parse Dashboard Node.js=8.3.0-alpha37
parseplatform Parse Dashboard Node.js=8.3.0-alpha38
parseplatform Parse Dashboard Node.js=8.3.0-alpha39
parseplatform Parse Dashboard Node.js=8.3.0-alpha4
parseplatform Parse Dashboard Node.js=8.3.0-alpha40
parseplatform Parse Dashboard Node.js=8.3.0-alpha41
parseplatform Parse Dashboard Node.js=8.3.0-alpha42
parseplatform Parse Dashboard Node.js=8.3.0-alpha43
parseplatform Parse Dashboard Node.js=8.3.0-alpha5
parseplatform Parse Dashboard Node.js=8.3.0-alpha6
parseplatform Parse Dashboard Node.js=8.3.0-alpha7
parseplatform Parse Dashboard Node.js=8.3.0-alpha8
parseplatform Parse Dashboard Node.js=8.3.0-alpha9
parseplatform Parse Dashboard Node.js=8.4.0-alpha1
parseplatform Parse Dashboard Node.js=8.4.1-alpha1
parseplatform Parse Dashboard Node.js=8.4.1-alpha2
parseplatform Parse Dashboard Node.js=8.5.0-alpha1
parseplatform Parse Dashboard Node.js=8.5.0-alpha2
parseplatform Parse Dashboard Node.js=8.5.0-alpha3
parseplatform Parse Dashboard Node.js=8.5.0-alpha4
parseplatform Parse Dashboard Node.js=8.5.0-alpha5
parseplatform Parse Dashboard Node.js=8.5.0-alpha6
parseplatform Parse Dashboard Node.js=8.5.0-alpha7
parseplatform Parse Dashboard Node.js=9.0.0-alpha1
parseplatform Parse Dashboard Node.js=9.0.0-alpha2
parseplatform Parse Dashboard Node.js=9.0.0-alpha3
parseplatform Parse Dashboard Node.js=9.0.0-alpha4
parseplatform Parse Dashboard Node.js=9.0.0-alpha5
parseplatform Parse Dashboard Node.js=9.0.0-alpha6
parseplatform Parse Dashboard Node.js=9.0.0-alpha7

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade npm/parse-dashboard to a version that resolves this vulnerability.

    Fixed in 9.0.0-alpha.8
  2. Upgrade

    Upgrade parse-community/parse-dashboard to a version that resolves this vulnerability.

    Fixed in 9.0.0-alpha.8Patch GHSA-3534-xp88-25rc
  3. Configuration

    Remove the `agent` configuration block from your dashboard configuration (Dashboards without an `agent` config are not affected).

    Parse Dashboard agent configuration block = removed
  4. Compensating control

    If you cannot upgrade immediately, ensure dashboards that would expose the AI Agent API endpoint do not include an `agent` configuration block so the `POST /apps/:appId/agent` endpoint is not used.

Event History

Feb 25, 2026
CVE Published
via MITRE·02:18 AM
Data Sourced
via MITRE·02:18 AM
DescriptionWeakness
Data Sourced
via NVD·03:16 AM
DescriptionSeverityWeaknessAffected Software
Advisory Published
via GitHub·06:59 PM
Data Sourced
via GitHub·06:59 PM
DescriptionWeaknessAffected Software
Oct 1, 58139
Event
via FIRST·10:43 AM
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2026-27609?

The vulnerability CVE-2026-27609 is considered to be of high severity due to the lack of CSRF protection allowing potential unauthorized actions on behalf of a user.

2

How do I fix CVE-2026-27609?

To mitigate CVE-2026-27609, update the Parse Dashboard to version 9.0.0-alpha.8 or higher, which includes the necessary CSRF protection.

3

What versions of Parse Dashboard are affected by CVE-2026-27609?

CVE-2026-27609 affects Parse Dashboard versions between 7.3.0-alpha.42 and 9.0.0-alpha.7.

4

Is user data at risk with CVE-2026-27609?

Yes, CVE-2026-27609 poses a risk to user data as attackers can exploit the CSRF vulnerability to send unauthorized requests on behalf of authenticated users.

5

What can I do to prevent attacks related to CVE-2026-27609?

To prevent attacks related to CVE-2026-27609, ensure that you upgrade to the patched version of Parse Dashboard and implement additional security measures such as monitoring user sessions.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203