Is CVE-2026-27610 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-27610 being exploited in the wild.

How severe is CVE-2026-27610?

Medium severity, with a CVSS score of 5.3, published 25 February 2026.

Which products and versions are affected?

parse-dashboard (npm) SEMVER:introduced=7.3.0-alpha.42,fixed=9.0.0-alpha.8.

Is there a fix for CVE-2026-27610?

Yes. parse-dashboard (npm): upgrade to 9.0.0-alpha.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-27610 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-27610?

Check whether you run parse-dashboard (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-27610: Parse Platform Parse Dashboard privilege escalation in ConfigKeyCache

CVE-2026-27610 · Severity: medium · CVSS 5.3 · Published 2026-02-25

Parse Dashboard, a management interface for Parse Server applications, contains a security flaw that could allow users with restricted access to gain full administrative control. Due to a technical error in how the system remembers security keys, a read-only user might accidentally be granted the 'master key' under specific timing conditions. This could allow an unauthorized person to modify or delete sensitive application data and bypass intended security restrictions.

Technologies: parse-dashboard (npm). Vendors: npm.

Quick answers

Is CVE-2026-27610 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-27610 being exploited in the wild.
How severe is CVE-2026-27610?: Medium severity, with a CVSS score of 5.3, published 25 February 2026.
Which products and versions are affected?: parse-dashboard (npm) SEMVER:introduced=7.3.0-alpha.42,fixed=9.0.0-alpha.8.
Is there a fix for CVE-2026-27610?: Yes. parse-dashboard (npm): upgrade to 9.0.0-alpha.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-27610 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-27610?: Check whether you run parse-dashboard (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

parse-dashboard (npm): upgrade to 9.0.0-alpha.8 or later
```
npm install parse-dashboard@9.0.0-alpha.8
```

Technical details

A cache key collision vulnerability exists in Parse Dashboard's ConfigKeyCache component. When resolving function-typed keys, the system fails to differentiate between the full master key and the read-only master key in its cache storage. An attacker with low-privileged (read-only) access can exploit specific timing conditions to retrieve the cached full master key, leading to unauthorized integrity impact on the underlying Parse Server. The vulnerability is present when function-typed master keys are used or when the 'agent' configuration block is active. A fix is available in version 9.0.0-alpha.8 which implements distinct cache keys.

Affected products

Parse Platform Parse Dashboard 7.3.0-alpha.42 through 9.0.0-alpha.7

Identifiers

CVE-2026-27610
GHSA-jhp4-jvq3-w5xr

Timeline

2026-02-19: patched: Version 9.0.0-alpha.8 released
2026-02-23: advisory: GitHub Advisory GHSA-jhp4-jvq3-w5xr published
2026-02-25: disclosed: CVE-2026-27610 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.