CVE-2026-66009 Overview
CVE-2026-66009 is an information disclosure vulnerability in Parse Server affecting versions >= 9.0.0 before 9.10.0-alpha.5 and >= 8.2.2 before 8.6.86. The flaw resides in the GraphQL API layer, where validation error messages reveal the names of required custom input fields even when public introspection is disabled through the graphQLPublicIntrospection: false setting. An unauthenticated client holding only the public application id can trigger these validation errors to enumerate required (non-null) custom fields on classes it already references by name. The issue partially defeats the schema-hiding intent of disabling public introspection, though it does not expose stored data, credentials, optional field names, unreferenced class names, or Cloud Code function names.
Critical Impact
Attackers with only the public application id can enumerate required custom field names on known Parse Server classes via GraphQL validation error messages, partially bypassing disabled introspection.
Affected Products
- Parse Server versions >= 9.0.0 before 9.10.0-alpha.5
- Parse Server versions >= 8.2.2 before 8.6.86
- Deployments running the GraphQL API with graphQLPublicIntrospection: false
Discovery Timeline
- 2026-07-24 - CVE-2026-66009 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-66009
Vulnerability Analysis
Parse Server exposes an optional GraphQL API alongside its REST interface. Administrators can disable public schema introspection by setting graphQLPublicIntrospection: false, the default, to hide class and field definitions from unauthenticated clients. Despite this setting, the GraphQL validation layer produces error messages that enumerate the names of required custom input fields when clients submit malformed mutations against known classes.
The weakness maps to [CWE-209: Generation of Error Message Containing Sensitive Information]. A client sending a mutation with missing arguments receives a validation error listing the required fields by name. Because Parse Server derives GraphQL type definitions directly from schema metadata, these messages leak structural details that introspection was intended to hide. The disclosure is bounded: only required fields on classes the attacker already references are exposed, and no data values, credentials, or Cloud Code function names are returned.
Root Cause
The root cause is inconsistent enforcement of the introspection-disabled policy. GraphQL validation runs before authorization, and Parse Server's validator emits standard graphql-js error text containing required field names. The graphQLPublicIntrospection flag suppresses introspection queries such as __schema and __type, but does not sanitize validation error strings, leaving a side channel through error responses.
Attack Vector
The attack is remote and unauthenticated. An attacker needs only the public application id, no session token, master key, or maintenance key. The attacker sends a GraphQL mutation naming a known Parse class with empty or partial input. Parse Server responds with a validation error message enumerating the required custom fields. Repeated crafted mutations against classes the attacker knows or guesses reveal the required-field schema for those classes.
See the GitHub Security Advisory GHSA-2fgh-8j2g-w354 and the VulnCheck Advisory on Parse Server for full technical details.
Detection Methods for CVE-2026-66009
Indicators of Compromise
- Bursts of GraphQL mutation requests from a single client with empty or partial input arguments targeting the same class.
- Repeated HTTP 400 or 200 responses from the /graphql endpoint carrying GraphQLError payloads that reference Field "..." of required type messages.
- Requests presenting only the X-Parse-Application-Id header, with no X-Parse-Session-Token, X-Parse-Master-Key, or X-Parse-Maintenance-Key.
Detection Strategies
- Parse Parse Server access logs for high-frequency GraphQL mutation attempts producing validation errors against the same class name.
- Alert on unauthenticated GraphQL clients that iterate through multiple class names within short time windows.
- Compare source IP behavior against legitimate application traffic baselines to identify enumeration patterns.
Monitoring Recommendations
- Enable verbose GraphQL request logging on Parse Server and forward events to a centralized analytics platform for correlation.
- Track the ratio of GraphQL validation errors to successful operations per client identifier and flag statistical outliers.
- Monitor for reconnaissance patterns preceding targeted data operations against the enumerated classes.
How to Mitigate CVE-2026-66009
Immediate Actions Required
- Upgrade Parse Server to version 9.10.0-alpha.5 or later on the 9.x branch, or 8.6.86 or later on the 8.x branch.
- Audit any custom classes exposed through the GraphQL API and review whether required-field naming reveals sensitive business logic.
- Rotate the public application id if reconnaissance activity is suspected against production deployments.
Patch Information
The Parse Server maintainers released fixes in versions 9.10.0-alpha.5 and 8.6.86. The patched builds suppress required-field names from GraphQL validation error messages when public introspection is disabled. Refer to the GitHub Security Advisory GHSA-2fgh-8j2g-w354 for release notes and commit references.
Workarounds
- Disable the GraphQL API entirely if it is not required by removing the mountGraphQL configuration until the patch can be applied.
- Place the /graphql endpoint behind an authenticated reverse proxy that rejects requests lacking a valid session or master key.
- Deploy a Web Application Firewall rule that strips or rewrites GraphQL error responses containing Field "..." of required type patterns for unauthenticated clients.
# Upgrade Parse Server via npm
npm install parse-server@9.10.0-alpha.5
# or for the 8.x branch
npm install parse-server@8.6.86
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
