Is CVE-2026-27609 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-27609 being exploited in the wild.

How severe is CVE-2026-27609?

Medium severity, with a CVSS score of 6.5, published 25 February 2026.

Which products and versions are affected?

parse-dashboard (npm) SEMVER:introduced=7.3.0-alpha.42,fixed=9.0.0-alpha.8.

Is there a fix for CVE-2026-27609?

Yes. parse-dashboard (npm): upgrade to 9.0.0-alpha.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-27609 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-27609?

Check whether you run parse-dashboard (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-27609: Parse Community Parse Dashboard CSRF in AI Agent API

CVE-2026-27609 · Severity: medium · CVSS 6.5 · Published 2026-02-25

Parse Dashboard is a web-based management interface for Parse Server backends. The AI Agent API endpoint lacks CSRF (Cross-Site Request Forgery) protection, allowing an attacker to craft a malicious webpage that tricks an authenticated dashboard user into submitting unintended requests. This could enable unauthorized actions within the dashboard when a logged-in user visits a compromised website.

Technologies: parse-dashboard (npm). Vendors: npm.

Quick answers

Is CVE-2026-27609 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-27609 being exploited in the wild.
How severe is CVE-2026-27609?: Medium severity, with a CVSS score of 6.5, published 25 February 2026.
Which products and versions are affected?: parse-dashboard (npm) SEMVER:introduced=7.3.0-alpha.42,fixed=9.0.0-alpha.8.
Is there a fix for CVE-2026-27609?: Yes. parse-dashboard (npm): upgrade to 9.0.0-alpha.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-27609 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-27609?: Check whether you run parse-dashboard (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

parse-dashboard (npm): upgrade to 9.0.0-alpha.8 or later
```
npm install parse-dashboard@9.0.0-alpha.8
```

Technical details

This is a Cross-Site Request Forgery (CWE-352) vulnerability in the AI Agent API endpoint of Parse Dashboard. The vulnerable component is the POST /apps/:appId/agent endpoint, which processes requests from authenticated users without verifying CSRF tokens. The attack requires network access to Parse Dashboard and user interaction (an authenticated user must visit a malicious page), but no special privileges are needed. An attacker can leverage the victim's authenticated session to submit arbitrary requests to the agent endpoint, potentially modifying application state or triggering unintended agent operations. The fix, available in version 9.0.0-alpha.8 and later, adds CSRF middleware to the agent endpoint and embeds CSRF tokens in the dashboard page.

Affected products

Parse Community Parse Dashboard >=7.3.0-alpha.42, <9.0.0-alpha.8

Identifiers

CVE-2026-27609
GHSA-3534-xp88-25rc

Timeline

2026-02-25: disclosed: Advisory GHSA-3534-xp88-25rc published
2026-02-19: patched: Fixed in version 9.0.0-alpha.8

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.