Is CVE-2026-66009 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-66009 being exploited in the wild.

How severe is CVE-2026-66009?

Informational severity, with a CVSS score of 6.3, published 24 July 2026.

Which products and versions are affected?

Parse Community Parse Server >= 9.0.0, = 8.2.2, < 8.6.86.

Is there a fix for CVE-2026-66009?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-66009 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-66009?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-66009: Parse Community Parse Server information disclosure in GraphQL error messages

Q: Is there a fix for CVE-2026-66009?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-66009 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-66009?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-66009 · Severity: info · CVSS 6.3 · Published 2026-07-24

Parse Server is an open-source backend framework used to build and host applications. A security issue was identified where the system inadvertently reveals the names of required data fields in its GraphQL API, even when security settings are configured to hide the database structure. While this does not expose actual user data or passwords, it allows unauthorized individuals to map out parts of the application's internal data structure, which could assist in planning more complex attacks.

Quick answers

Is CVE-2026-66009 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-66009 being exploited in the wild.
How severe is CVE-2026-66009?: Informational severity, with a CVSS score of 6.3, published 24 July 2026.
Which products and versions are affected?: Parse Community Parse Server >= 9.0.0, < 9.10.0-alpha.5; >= 8.2.2, < 8.6.86.
Is there a fix for CVE-2026-66009?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-66009 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-66009?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An information disclosure vulnerability exists in Parse Server's GraphQL API implementation. When 'graphQLPublicIntrospection' is set to false (the default), the server still returns verbose validation error messages that explicitly name missing required (non-null) custom input fields. An unauthenticated attacker with only the public application ID can trigger these errors by sending malformed requests to known classes. This bypasses the intended schema-hiding security control, though it is limited to required field names and does not expose stored data, optional fields, or unreferenced classes. The issue is resolved in versions 9.10.0-alpha.5 and 8.6.86 by redacting schema identifiers from error messages for non-privileged callers.

Affected products

Parse Community Parse Server >= 9.0.0, < 9.10.0-alpha.5; >= 8.2.2, < 8.6.86

Timeline

2026-07-10: advisory: GitHub Security Advisory published by maintainers
2026-07-24: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.