CVE-2026-27610: Parse Dashboard Has a Cache Key Collision that Leaks Master Key to Read-Only Sessions

Published Feb 25, 2026
·
Updated

Impact

The ConfigKeyCache uses the same cache key for both master key and read-only master key when resolving function-typed keys. Under specific timing conditions, a read-only user can receive the cached full master key, or a regular user can receive the cached read-only master key.

Patches

The fix uses distinct cache keys for master key and read-only master key.

Workarounds

Avoid using function-typed master keys, or remove the agent configuration block from your dashboard configuration.

Resources

- GitHub advisory: https://github.com/parse-community/parse-dashboard/security/advisories/GHSA-jhp4-jvq3-w5xr - Fixed in: https://github.com/parse-community/parse-dashboard/releases/tag/9.0.0-alpha.8

Other sources

Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the ConfigKeyCache uses the same cache key for both master key and read-only master key when resolving function-typed keys. Under specific timing conditions, a read-only user can receive the cached full master key, or a regular user can receive the cached read-only master key. The fix in version 9.0.0-alpha.8 uses distinct cache keys for master key and read-only master key. As a workaround, avoid using function-typed master keys, or remove the agent configuration block from your dashboard configuration.

— MITRE

Affected Software

272 affected componentsFixes available
npm/parse-dashboard>=7.3.0-alpha.42<9.0.0-alpha.7
npm/parse-dashboard>=7.3.0-alpha.42<9.0.0-alpha.8
9.0.0-alpha.8
parseplatform Parse Dashboard Node.js=7.3.0-alpha.42
parseplatform Parse Dashboard Node.js=7.3.0-alpha.43
parseplatform Parse Dashboard Node.js=7.3.0-alpha.44
parseplatform Parse Dashboard Node.js=7.3.0-alpha.5
parseplatform Parse Dashboard Node.js=7.3.0-alpha.6
parseplatform Parse Dashboard Node.js=7.3.0-alpha.7
parseplatform Parse Dashboard Node.js=7.3.0-alpha.8
parseplatform Parse Dashboard Node.js=7.3.0-alpha.9
parseplatform Parse Dashboard Node.js=7.4.0-alpha.1
parseplatform Parse Dashboard Node.js=7.4.0-alpha.2
parseplatform Parse Dashboard Node.js=7.4.0-alpha.3
parseplatform Parse Dashboard Node.js=7.4.0-alpha.4
parseplatform Parse Dashboard Node.js=7.4.0-alpha.5
parseplatform Parse Dashboard Node.js=7.5.0-alpha.1
parseplatform Parse Dashboard Node.js=7.5.0-alpha.2
parseplatform Parse Dashboard Node.js=7.6.0-alpha.1
parseplatform Parse Dashboard Node.js=7.6.0-alpha.10
parseplatform Parse Dashboard Node.js=7.6.0-alpha.11
parseplatform Parse Dashboard Node.js=7.6.0-alpha.12
parseplatform Parse Dashboard Node.js=7.6.0-alpha.13
parseplatform Parse Dashboard Node.js=7.6.0-alpha.2
parseplatform Parse Dashboard Node.js=7.6.0-alpha.3
parseplatform Parse Dashboard Node.js=7.6.0-alpha.4
parseplatform Parse Dashboard Node.js=7.6.0-alpha.5
parseplatform Parse Dashboard Node.js=7.6.0-alpha.6
parseplatform Parse Dashboard Node.js=7.6.0-alpha.7
parseplatform Parse Dashboard Node.js=7.6.0-alpha.8
parseplatform Parse Dashboard Node.js=7.6.0-alpha.9
parseplatform Parse Dashboard Node.js=8.0.0-alpha.1
parseplatform Parse Dashboard Node.js=8.0.0-alpha.2
parseplatform Parse Dashboard Node.js=8.0.0-alpha.3
parseplatform Parse Dashboard Node.js=8.0.0-alpha.4
parseplatform Parse Dashboard Node.js=8.0.0-alpha.5
parseplatform Parse Dashboard Node.js=8.0.0-alpha.6
parseplatform Parse Dashboard Node.js=8.1.0-alpha.1
parseplatform Parse Dashboard Node.js=8.1.0-alpha.10
parseplatform Parse Dashboard Node.js=8.1.0-alpha.11
parseplatform Parse Dashboard Node.js=8.1.0-alpha.12
parseplatform Parse Dashboard Node.js=8.1.0-alpha.13
parseplatform Parse Dashboard Node.js=8.1.0-alpha.2
parseplatform Parse Dashboard Node.js=8.1.0-alpha.3
parseplatform Parse Dashboard Node.js=8.1.0-alpha.4
parseplatform Parse Dashboard Node.js=8.1.0-alpha.5
parseplatform Parse Dashboard Node.js=8.1.0-alpha.6
parseplatform Parse Dashboard Node.js=8.1.0-alpha.7
parseplatform Parse Dashboard Node.js=8.1.0-alpha.8
parseplatform Parse Dashboard Node.js=8.1.0-alpha.9
parseplatform Parse Dashboard Node.js=8.1.1-alpha.1
parseplatform Parse Dashboard Node.js=8.2.0-alpha.1
parseplatform Parse Dashboard Node.js=8.2.0-alpha.10
parseplatform Parse Dashboard Node.js=8.2.0-alpha.11
parseplatform Parse Dashboard Node.js=8.2.0-alpha.12
parseplatform Parse Dashboard Node.js=8.2.0-alpha.13
parseplatform Parse Dashboard Node.js=8.2.0-alpha.14
parseplatform Parse Dashboard Node.js=8.2.0-alpha.15
parseplatform Parse Dashboard Node.js=8.2.0-alpha.16
parseplatform Parse Dashboard Node.js=8.2.0-alpha.17
parseplatform Parse Dashboard Node.js=8.2.0-alpha.18
parseplatform Parse Dashboard Node.js=8.2.0-alpha.19
parseplatform Parse Dashboard Node.js=8.2.0-alpha.2
parseplatform Parse Dashboard Node.js=8.2.0-alpha.20
parseplatform Parse Dashboard Node.js=8.2.0-alpha.21
parseplatform Parse Dashboard Node.js=8.2.0-alpha.22
parseplatform Parse Dashboard Node.js=8.2.0-alpha.23
parseplatform Parse Dashboard Node.js=8.2.0-alpha.24
parseplatform Parse Dashboard Node.js=8.2.0-alpha.25
parseplatform Parse Dashboard Node.js=8.2.0-alpha.26
parseplatform Parse Dashboard Node.js=8.2.0-alpha.27
parseplatform Parse Dashboard Node.js=8.2.0-alpha.3
parseplatform Parse Dashboard Node.js=8.2.0-alpha.4
parseplatform Parse Dashboard Node.js=8.2.0-alpha.5
parseplatform Parse Dashboard Node.js=8.2.0-alpha.6
parseplatform Parse Dashboard Node.js=8.2.0-alpha.7
parseplatform Parse Dashboard Node.js=8.2.0-alpha.8
parseplatform Parse Dashboard Node.js=8.2.0-alpha.9
parseplatform Parse Dashboard Node.js=8.3.0-alpha.1
parseplatform Parse Dashboard Node.js=8.3.0-alpha.10
parseplatform Parse Dashboard Node.js=8.3.0-alpha.11
parseplatform Parse Dashboard Node.js=8.3.0-alpha.12
parseplatform Parse Dashboard Node.js=8.3.0-alpha.13
parseplatform Parse Dashboard Node.js=8.3.0-alpha.14
parseplatform Parse Dashboard Node.js=8.3.0-alpha.15
parseplatform Parse Dashboard Node.js=8.3.0-alpha.16
parseplatform Parse Dashboard Node.js=8.3.0-alpha.17
parseplatform Parse Dashboard Node.js=8.3.0-alpha.18
parseplatform Parse Dashboard Node.js=8.3.0-alpha.19
parseplatform Parse Dashboard Node.js=8.3.0-alpha.2
parseplatform Parse Dashboard Node.js=8.3.0-alpha.20
parseplatform Parse Dashboard Node.js=8.3.0-alpha.21
parseplatform Parse Dashboard Node.js=8.3.0-alpha.22
parseplatform Parse Dashboard Node.js=8.3.0-alpha.23
parseplatform Parse Dashboard Node.js=8.3.0-alpha.24
parseplatform Parse Dashboard Node.js=8.3.0-alpha.25
parseplatform Parse Dashboard Node.js=8.3.0-alpha.26
parseplatform Parse Dashboard Node.js=8.3.0-alpha.27
parseplatform Parse Dashboard Node.js=8.3.0-alpha.28
parseplatform Parse Dashboard Node.js=8.3.0-alpha.29
parseplatform Parse Dashboard Node.js=8.3.0-alpha.3
parseplatform Parse Dashboard Node.js=8.3.0-alpha.30
parseplatform Parse Dashboard Node.js=8.3.0-alpha.31
parseplatform Parse Dashboard Node.js=8.3.0-alpha.32
parseplatform Parse Dashboard Node.js=8.3.0-alpha.33
parseplatform Parse Dashboard Node.js=8.3.0-alpha.34
parseplatform Parse Dashboard Node.js=8.3.0-alpha.35
parseplatform Parse Dashboard Node.js=8.3.0-alpha.36
parseplatform Parse Dashboard Node.js=8.3.0-alpha.37
parseplatform Parse Dashboard Node.js=8.3.0-alpha.38
parseplatform Parse Dashboard Node.js=8.3.0-alpha.39
parseplatform Parse Dashboard Node.js=8.3.0-alpha.4
parseplatform Parse Dashboard Node.js=8.3.0-alpha.40
parseplatform Parse Dashboard Node.js=8.3.0-alpha.41
parseplatform Parse Dashboard Node.js=8.3.0-alpha.42
parseplatform Parse Dashboard Node.js=8.3.0-alpha.43
parseplatform Parse Dashboard Node.js=8.3.0-alpha.5
parseplatform Parse Dashboard Node.js=8.3.0-alpha.6
parseplatform Parse Dashboard Node.js=8.3.0-alpha.7
parseplatform Parse Dashboard Node.js=8.3.0-alpha.8
parseplatform Parse Dashboard Node.js=8.3.0-alpha.9
parseplatform Parse Dashboard Node.js=8.4.0-alpha.1
parseplatform Parse Dashboard Node.js=8.4.1-alpha.1
parseplatform Parse Dashboard Node.js=8.4.1-alpha.2
parseplatform Parse Dashboard Node.js=8.5.0-alpha.1
parseplatform Parse Dashboard Node.js=8.5.0-alpha.2
parseplatform Parse Dashboard Node.js=8.5.0-alpha.3
parseplatform Parse Dashboard Node.js=8.5.0-alpha.4
parseplatform Parse Dashboard Node.js=8.5.0-alpha.5
parseplatform Parse Dashboard Node.js=8.5.0-alpha.6
parseplatform Parse Dashboard Node.js=8.5.0-alpha.7
parseplatform Parse Dashboard Node.js=9.0.0-alpha.1
parseplatform Parse Dashboard Node.js=9.0.0-alpha.2
parseplatform Parse Dashboard Node.js=9.0.0-alpha.3
parseplatform Parse Dashboard Node.js=9.0.0-alpha.4
parseplatform Parse Dashboard Node.js=9.0.0-alpha.5
parseplatform Parse Dashboard Node.js=9.0.0-alpha.6
parseplatform Parse Dashboard Node.js=9.0.0-alpha.7
parseplatform Parse Dashboard Node.js=7.3.0-alpha42
parseplatform Parse Dashboard Node.js=7.3.0-alpha43
parseplatform Parse Dashboard Node.js=7.3.0-alpha44
parseplatform Parse Dashboard Node.js=7.3.0-alpha5
parseplatform Parse Dashboard Node.js=7.3.0-alpha6
parseplatform Parse Dashboard Node.js=7.3.0-alpha7
parseplatform Parse Dashboard Node.js=7.3.0-alpha8
parseplatform Parse Dashboard Node.js=7.3.0-alpha9
parseplatform Parse Dashboard Node.js=7.4.0-alpha1
parseplatform Parse Dashboard Node.js=7.4.0-alpha2
parseplatform Parse Dashboard Node.js=7.4.0-alpha3
parseplatform Parse Dashboard Node.js=7.4.0-alpha4
parseplatform Parse Dashboard Node.js=7.4.0-alpha5
parseplatform Parse Dashboard Node.js=7.5.0-alpha1
parseplatform Parse Dashboard Node.js=7.5.0-alpha2
parseplatform Parse Dashboard Node.js=7.6.0-alpha1
parseplatform Parse Dashboard Node.js=7.6.0-alpha10
parseplatform Parse Dashboard Node.js=7.6.0-alpha11
parseplatform Parse Dashboard Node.js=7.6.0-alpha12
parseplatform Parse Dashboard Node.js=7.6.0-alpha13
parseplatform Parse Dashboard Node.js=7.6.0-alpha2
parseplatform Parse Dashboard Node.js=7.6.0-alpha3
parseplatform Parse Dashboard Node.js=7.6.0-alpha4
parseplatform Parse Dashboard Node.js=7.6.0-alpha5
parseplatform Parse Dashboard Node.js=7.6.0-alpha6
parseplatform Parse Dashboard Node.js=7.6.0-alpha7
parseplatform Parse Dashboard Node.js=7.6.0-alpha8
parseplatform Parse Dashboard Node.js=7.6.0-alpha9
parseplatform Parse Dashboard Node.js=8.0.0-alpha1
parseplatform Parse Dashboard Node.js=8.0.0-alpha2
parseplatform Parse Dashboard Node.js=8.0.0-alpha3
parseplatform Parse Dashboard Node.js=8.0.0-alpha4
parseplatform Parse Dashboard Node.js=8.0.0-alpha5
parseplatform Parse Dashboard Node.js=8.0.0-alpha6
parseplatform Parse Dashboard Node.js=8.1.0-alpha1
parseplatform Parse Dashboard Node.js=8.1.0-alpha10
parseplatform Parse Dashboard Node.js=8.1.0-alpha11
parseplatform Parse Dashboard Node.js=8.1.0-alpha12
parseplatform Parse Dashboard Node.js=8.1.0-alpha13
parseplatform Parse Dashboard Node.js=8.1.0-alpha2
parseplatform Parse Dashboard Node.js=8.1.0-alpha3
parseplatform Parse Dashboard Node.js=8.1.0-alpha4
parseplatform Parse Dashboard Node.js=8.1.0-alpha5
parseplatform Parse Dashboard Node.js=8.1.0-alpha6
parseplatform Parse Dashboard Node.js=8.1.0-alpha7
parseplatform Parse Dashboard Node.js=8.1.0-alpha8
parseplatform Parse Dashboard Node.js=8.1.0-alpha9
parseplatform Parse Dashboard Node.js=8.1.1-alpha1
parseplatform Parse Dashboard Node.js=8.2.0-alpha1
parseplatform Parse Dashboard Node.js=8.2.0-alpha10
parseplatform Parse Dashboard Node.js=8.2.0-alpha11
parseplatform Parse Dashboard Node.js=8.2.0-alpha12
parseplatform Parse Dashboard Node.js=8.2.0-alpha13
parseplatform Parse Dashboard Node.js=8.2.0-alpha14
parseplatform Parse Dashboard Node.js=8.2.0-alpha15
parseplatform Parse Dashboard Node.js=8.2.0-alpha16
parseplatform Parse Dashboard Node.js=8.2.0-alpha17
parseplatform Parse Dashboard Node.js=8.2.0-alpha18
parseplatform Parse Dashboard Node.js=8.2.0-alpha19
parseplatform Parse Dashboard Node.js=8.2.0-alpha2
parseplatform Parse Dashboard Node.js=8.2.0-alpha20
parseplatform Parse Dashboard Node.js=8.2.0-alpha21
parseplatform Parse Dashboard Node.js=8.2.0-alpha22
parseplatform Parse Dashboard Node.js=8.2.0-alpha23
parseplatform Parse Dashboard Node.js=8.2.0-alpha24
parseplatform Parse Dashboard Node.js=8.2.0-alpha25
parseplatform Parse Dashboard Node.js=8.2.0-alpha26
parseplatform Parse Dashboard Node.js=8.2.0-alpha27
parseplatform Parse Dashboard Node.js=8.2.0-alpha3
parseplatform Parse Dashboard Node.js=8.2.0-alpha4
parseplatform Parse Dashboard Node.js=8.2.0-alpha5
parseplatform Parse Dashboard Node.js=8.2.0-alpha6
parseplatform Parse Dashboard Node.js=8.2.0-alpha7
parseplatform Parse Dashboard Node.js=8.2.0-alpha8
parseplatform Parse Dashboard Node.js=8.2.0-alpha9
parseplatform Parse Dashboard Node.js=8.3.0-alpha1
parseplatform Parse Dashboard Node.js=8.3.0-alpha10
parseplatform Parse Dashboard Node.js=8.3.0-alpha11
parseplatform Parse Dashboard Node.js=8.3.0-alpha12
parseplatform Parse Dashboard Node.js=8.3.0-alpha13
parseplatform Parse Dashboard Node.js=8.3.0-alpha14
parseplatform Parse Dashboard Node.js=8.3.0-alpha15
parseplatform Parse Dashboard Node.js=8.3.0-alpha16
parseplatform Parse Dashboard Node.js=8.3.0-alpha17
parseplatform Parse Dashboard Node.js=8.3.0-alpha18
parseplatform Parse Dashboard Node.js=8.3.0-alpha19
parseplatform Parse Dashboard Node.js=8.3.0-alpha2
parseplatform Parse Dashboard Node.js=8.3.0-alpha20
parseplatform Parse Dashboard Node.js=8.3.0-alpha21
parseplatform Parse Dashboard Node.js=8.3.0-alpha22
parseplatform Parse Dashboard Node.js=8.3.0-alpha23
parseplatform Parse Dashboard Node.js=8.3.0-alpha24
parseplatform Parse Dashboard Node.js=8.3.0-alpha25
parseplatform Parse Dashboard Node.js=8.3.0-alpha26
parseplatform Parse Dashboard Node.js=8.3.0-alpha27
parseplatform Parse Dashboard Node.js=8.3.0-alpha28
parseplatform Parse Dashboard Node.js=8.3.0-alpha29
parseplatform Parse Dashboard Node.js=8.3.0-alpha3
parseplatform Parse Dashboard Node.js=8.3.0-alpha30
parseplatform Parse Dashboard Node.js=8.3.0-alpha31
parseplatform Parse Dashboard Node.js=8.3.0-alpha32
parseplatform Parse Dashboard Node.js=8.3.0-alpha33
parseplatform Parse Dashboard Node.js=8.3.0-alpha34
parseplatform Parse Dashboard Node.js=8.3.0-alpha35
parseplatform Parse Dashboard Node.js=8.3.0-alpha36
parseplatform Parse Dashboard Node.js=8.3.0-alpha37
parseplatform Parse Dashboard Node.js=8.3.0-alpha38
parseplatform Parse Dashboard Node.js=8.3.0-alpha39
parseplatform Parse Dashboard Node.js=8.3.0-alpha4
parseplatform Parse Dashboard Node.js=8.3.0-alpha40
parseplatform Parse Dashboard Node.js=8.3.0-alpha41
parseplatform Parse Dashboard Node.js=8.3.0-alpha42
parseplatform Parse Dashboard Node.js=8.3.0-alpha43
parseplatform Parse Dashboard Node.js=8.3.0-alpha5
parseplatform Parse Dashboard Node.js=8.3.0-alpha6
parseplatform Parse Dashboard Node.js=8.3.0-alpha7
parseplatform Parse Dashboard Node.js=8.3.0-alpha8
parseplatform Parse Dashboard Node.js=8.3.0-alpha9
parseplatform Parse Dashboard Node.js=8.4.0-alpha1
parseplatform Parse Dashboard Node.js=8.4.1-alpha1
parseplatform Parse Dashboard Node.js=8.4.1-alpha2
parseplatform Parse Dashboard Node.js=8.5.0-alpha1
parseplatform Parse Dashboard Node.js=8.5.0-alpha2
parseplatform Parse Dashboard Node.js=8.5.0-alpha3
parseplatform Parse Dashboard Node.js=8.5.0-alpha4
parseplatform Parse Dashboard Node.js=8.5.0-alpha5
parseplatform Parse Dashboard Node.js=8.5.0-alpha6
parseplatform Parse Dashboard Node.js=8.5.0-alpha7
parseplatform Parse Dashboard Node.js=9.0.0-alpha1
parseplatform Parse Dashboard Node.js=9.0.0-alpha2
parseplatform Parse Dashboard Node.js=9.0.0-alpha3
parseplatform Parse Dashboard Node.js=9.0.0-alpha4
parseplatform Parse Dashboard Node.js=9.0.0-alpha5
parseplatform Parse Dashboard Node.js=9.0.0-alpha6
parseplatform Parse Dashboard Node.js=9.0.0-alpha7

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade npm/parse-dashboard to a version that resolves this vulnerability.

    Fixed in 9.0.0-alpha.8
  2. Upgrade

    Upgrade parse-community/parse-dashboard to a version that resolves this vulnerability.

    Fixed in 9.0.0-alpha.8
  3. Configuration

    As a workaround, remove the `agent` configuration block from your dashboard configuration.

    Parse Dashboard agent configuration block = remove
  4. Compensating control

    As a workaround, avoid using function-typed master keys.

Event History

Feb 25, 2026
CVE Published
via MITRE·02:19 AM
Data Sourced
via MITRE·02:19 AM
DescriptionWeakness
Data Sourced
via NVD·03:16 AM
RemedyDescriptionSeverityWeaknessAffected Software
Advisory Published
via GitHub·07:00 PM
Data Sourced
via GitHub·07:00 PM
DescriptionWeaknessAffected Software
Oct 1, 58139
Event
via FIRST·09:33 PM
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2026-27610?

CVE-2026-27610 is considered a moderate severity vulnerability due to potential information leakage of the master key.

2

How do I fix CVE-2026-27610?

To mitigate CVE-2026-27610, upgrade to version 9.0.0-alpha.8 or higher of the Parse Dashboard.

3

What specific issues does CVE-2026-27610 cause?

CVE-2026-27610 results in a cache key collision, allowing read-only users to potentially access sensitive data erroneously.

4

Which versions of Parse Dashboard are affected by CVE-2026-27610?

CVE-2026-27610 affects Parse Dashboard versions from 7.3.0-alpha.42 to 9.0.0-alpha.7.

5

Is CVE-2026-27610 a common vulnerability in web applications?

CVE-2026-27610 highlights a common vulnerability related to caching mechanisms, which can lead to data leaks if not properly managed.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203