CVE-2026-109302: Parse Server GraphQL Information Disclosure

CVE-2026-109302 Overview

CVE-2026-109302 is an authorization flaw in Parse Server affecting versions 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14. The server enforces its GraphQL introspection control only on operation text supplied directly with a request. Operations resolved from Apollo Server's automatic persisted query (APQ) cache bypass this check. An unauthenticated attacker who holds the public Application Id and client key can replay an introspection query previously cached by a privileged client. The replay returns the full GraphQL schema, including private class and field names intended to remain hidden.

Critical Impact
Unauthenticated attackers can retrieve the private GraphQL schema, exposing internal class and field names that aid further targeted attacks.

Affected Products

Parse Server versions 8.2.2 through 8.6.93
Parse Server versions 9.0.0 through 9.10.1-alpha.13
Deployments using Apollo Server automatic persisted queries

Discovery Timeline

2026-10-12 - CVE-2026-109302 published to NVD
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-109302

Vulnerability Analysis

Parse Server exposes a GraphQL API backed by Apollo Server. Operators can disable introspection to prevent clients from enumerating the schema. The disable check inspects the inline query text contained in the HTTP request body. Apollo Server supports automatic persisted queries, where clients send a SHA-256 hash referencing a server-cached operation instead of the full query text. When Parse Server resolves a request from the APQ cache, it executes the cached operation without re-applying the introspection gate. This mismatch is an authorization weakness classified under CWE-863: Incorrect Authorization.

Root Cause

The introspection control is applied at the request parsing stage rather than at the GraphQL execution stage. Operations loaded from the APQ cache are already parsed and skip the text-based inspection. An introspection query cached earlier by a legitimate master key or maintenance key client remains addressable by its hash. Any client that knows the hash can trigger execution.

Attack Vector

An attacker needs network access to the Parse Server GraphQL endpoint and the public Application Id and client key, both of which are typically embedded in frontend applications. The attacker issues a GraphQL request containing only the persistedQuery extension with a sha256Hash matching a previously cached introspection query. Apollo Server resolves the hash to the cached __schema operation and executes it. The response discloses object types, fields, input arguments, and relationships, including entries marked private by the application developer. The disclosed schema enables targeted follow-on queries against sensitive classes.

Detection Methods for CVE-2026-109302

Indicators of Compromise

GraphQL requests containing an extensions.persistedQuery object with a sha256Hash and no query field, originating from unauthenticated or untrusted clients.
Response payloads containing __schema or __type field data returned to clients that lack a master or maintenance key header.
Repeated POST requests to the Parse Server GraphQL endpoint from a single source using identical persisted query hashes.

Detection Strategies

Log and inspect GraphQL request bodies for persisted query extensions that resolve to introspection operations.
Correlate client key usage with request types, flagging introspection responses served to non-privileged keys.
Deploy a GraphQL-aware proxy or WAF rule that blocks responses containing __schema for unauthenticated sessions.

Monitoring Recommendations

Enable verbose request logging on Parse Server and ship GraphQL access logs to a central analytics platform.
Alert on first-seen sha256Hash values that return large response payloads shortly after deployment or restart.
Monitor Apollo Server APQ cache contents for persisted introspection operations and purge them on detection.

How to Mitigate CVE-2026-109302

Immediate Actions Required

Upgrade Parse Server to version 8.6.94 or 9.10.1-alpha.14 as applicable to your release line.
Rotate the public client key if schema disclosure is suspected, and audit GraphQL access logs for persisted introspection replays.
Disable the automatic persisted query cache if upgrading is not immediately possible.

Patch Information

The maintainers released fixes in Parse Server 8.6.94 and 9.10.1-alpha.14. The patch applies the introspection control to operations resolved from the APQ cache as well as inline operations. See the GitHub Security Advisory GHSA-gxxq-pghq-9vrc and the VulnCheck Advisory for full technical details.

Workarounds

Disable GraphQL introspection and the APQ feature in Apollo Server configuration until the patched version is deployed.
Restrict GraphQL endpoint access to authenticated clients using master or maintenance keys where business logic allows.
Place the GraphQL endpoint behind an authenticating reverse proxy that strips extensions.persistedQuery fields from untrusted clients.

bash

# Upgrade Parse Server to the patched release
npm install parse-server@8.6.94
# or for the 9.x line
npm install parse-server@9.10.1-alpha.14