CVE-2026-27610: Parse Dashboard Has a Cache Key Collision that Leaks Master Key to Read-Only Sessions
The ConfigKeyCache uses the same cache key for both master key and read-only master key when resolving function-typed keys. Under specific timing conditions, a read-only user can receive the cached full master key, or a regular user can receive the cached read-only master key.
References
- github.com/advisories/GHSA-jhp4-jvq3-w5xr
- github.com/parse-community/parse-dashboard
- github.com/parse-community/parse-dashboard/commit/f92a9ef5246d57e51696bd881a15f3b133b2bb50
- github.com/parse-community/parse-dashboard/releases/tag/9.0.0-alpha.8
- github.com/parse-community/parse-dashboard/security/advisories/GHSA-jhp4-jvq3-w5xr
- nvd.nist.gov/vuln/detail/CVE-2026-27610
Code Behaviors & Features
Detect and mitigate CVE-2026-27610 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →