CVE-2026-66008: Parse Server Information Disclosure Flaw

CVE-2026-66008 Overview

CVE-2026-66008 is an information disclosure vulnerability in Parse Server affecting versions >= 9.0.0 before 9.10.0-alpha.6 and >= 8.2.2 before 8.6.87. The flaw exists in the GraphQL validation and input-coercion layer, which surfaces Pointer and Relation target class names in error messages even when public schema introspection is disabled via graphQLPublicIntrospection: false. Errors are returned before authentication, authorization, or resolvers execute. An unauthenticated client that knows only the public application ID can reconstruct hidden schema class names. The vulnerability maps to [CWE-209: Generation of Error Message Containing Sensitive Information].

Critical Impact
An unauthenticated attacker can enumerate hidden Parse Server class names via GraphQL errors, partially defeating schema-hiding protections. Object data, credentials, and user records are not exposed.

Affected Products

Parse Server >= 9.0.0 and < 9.10.0-alpha.6
Parse Server >= 8.2.2 and < 8.6.87
Deployments running with graphQLPublicIntrospection: false (the default)

Discovery Timeline

2026-07-24 - CVE-2026-66008 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-66008

Vulnerability Analysis

Parse Server exposes a GraphQL API that supports Pointer and Relation field types referencing other classes. When graphQLPublicIntrospection is disabled, operators expect that schema metadata cannot be enumerated by unauthenticated clients. This vulnerability breaks that assumption. GraphQL validation and input-coercion errors are generated during query parsing, which runs before authentication, authorization, and resolver logic. The resulting error responses embed the target class name of Pointer and Relation fields, allowing a caller with only the public application ID to discover hidden class names by iterating field-level errors. Only schema metadata leaks; object contents, session tokens, and user data are unaffected.

Root Cause

The root cause is verbose error construction in the GraphQL layer. Parse Server includes internal type metadata, specifically Pointer and Relation target class names, in validation and coercion error text. These errors are produced by the GraphQL engine before the request enters the Parse authentication pipeline, so the schema-hiding control cannot filter them.

Attack Vector

An unauthenticated remote attacker sends crafted GraphQL queries or mutations that reference Pointer or Relation fields with intentionally invalid input. The attacker only requires network reachability to the /graphql endpoint and the public X-Parse-Application-Id header. Parsing the returned error messages yields hidden class names, which the attacker can chain with other techniques to map the application data model.

No verified proof-of-concept code is publicly linked in the advisory. See the GitHub Security Advisory and the VulnCheck Information Disclosure Advisory for the maintainer's technical description.

Detection Methods for CVE-2026-66008

Indicators of Compromise

Unauthenticated GraphQL requests to /graphql that repeatedly trigger validation or input-coercion errors on Pointer or Relation fields.
HTTP responses from Parse Server containing GraphQL error payloads that include class names not present in the public schema.
High volumes of GraphQL requests with only the X-Parse-Application-Id header and no session token.

Detection Strategies

Instrument the GraphQL endpoint to log full error responses and correlate error rates per client IP and application ID.
Alert on unauthenticated GraphQL traffic that produces schema-related error strings such as coercion failures on Pointer or Relation inputs.
Baseline normal GraphQL error rates and flag deviations that suggest enumeration behavior.

Monitoring Recommendations

Forward Parse Server access and error logs to a centralized analytics platform for retention and query.
Track requests-per-minute against /graphql from unauthenticated sessions and rate-limit outliers.
Review GraphQL error payloads returned to clients and confirm they no longer include internal class metadata after patching.

How to Mitigate CVE-2026-66008

Immediate Actions Required

Upgrade Parse Server to 9.10.0-alpha.6 or later on the 9.x branch, or to 8.6.87 or later on the 8.x branch.
Inventory Parse Server deployments and confirm graphQLPublicIntrospection is set to false while patching is in progress.
Rate-limit and monitor unauthenticated GraphQL traffic during the remediation window.

Patch Information

The Parse Server maintainers released fixes in 9.10.0-alpha.6 and 8.6.87. The patch removes Pointer and Relation target class names from GraphQL validation and input-coercion error messages so that unauthenticated callers cannot enumerate hidden classes. Full remediation details are in the GitHub Security Advisory GHSA-r2g6-4f6j-f6rf.

Workarounds

Disable the GraphQL API entirely if it is not required by the application until the patched version is deployed.
Place a reverse proxy or API gateway in front of Parse Server to strip or sanitize GraphQL error responses returned to unauthenticated clients.
Restrict network access to /graphql to authenticated backend services where feasible.

bash

# Configuration example: upgrade Parse Server to a patched release
npm install parse-server@8.6.87
# or for the 9.x branch
npm install parse-server@9.10.0-alpha.6