CVE-2026-27595: Parse Dashboard has incomplete authentication on AI Agent endpoint
Impact The AI Agent API endpoint (POST /apps/:appId/agent) lacks authentication. Unauthenticated remote attackers can send requests to the endpoint and perform arbitrary database operations against any connected Parse Server using the master key. Patches The fix adds authentication middleware to the agent endpoint. Workarounds Remove the agent configuration block from your dashboard configuration.
Published Feb 25, 2026
Affected packages
parse-dashboard
- Ecosystem
- npm
- Affected
- >= 7.3.0-alpha.42, < 9.0.0-alpha.8
- Fixed in
- 9.0.0-alpha.8
- Check
npm ls parse-dashboard
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Impact
The AI Agent API endpoint (POST /apps/:appId/agent) lacks authentication. Unauthenticated remote attackers can send requests to the endpoint and perform arbitrary database operations against any connected Parse Server using the master key.
Patches
The fix adds authentication middleware to the agent endpoint.
Workarounds
Remove the agent configuration block from your dashboard configuration. Dashboards without an agent config are not affected.
Resources
- GitHub advisory: https://github.com/parse-community/parse-dashboard/security/advisories/GHSA-qwc3-h9mg-4582
- Fixed in: https://github.com/parse-community/parse-dashboard/releases/tag/9.0.0-alpha.8
Credited to ByamB4, mtrezza.
References
- https://github.com/parse-community/parse-dashboard/security/advisories/GHSA-qwc3-h9mg-4582
- https://nvd.nist.gov/vuln/detail/CVE-2026-27595
- https://github.com/parse-community/parse-dashboard/commit/f92a9ef5246d57e51696bd881a15f3b133b2bb50
- https://github.com/parse-community/parse-dashboard/releases/tag/9.0.0-alpha.8
- https://github.com/advisories/GHSA-qwc3-h9mg-4582
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology