Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. From version 9.3.1-alpha.3 to before version 9.5.0-alpha.10, when graphQLPublicIntrospection is disabled, __type queries nested inside inline fragments (e.g. ... on Query { __type(name:"User") { name } }) bypass the introspection control, allowing unauthenticated users to perform type reconnaissance. __schema introspection is not affected. This issue has been patched in version 9.5.0-alpha.10.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
2 versions affected across 1 product
| Date | Total | Labels |
|---|
| 2026-03-07 | 2 | Disclosure1General1 |
| 2026-03-09 | 1 | Disclosure1 |
🟠 Parse Server: GraphQL Introspection Bypass via Inline Fragments (#CVE-2026-30854) - Moderate https://dailycve.com/parse-server-graphql-introspection-bypass-via-inline-fragments-cve-2026-30854-moderate/
Post summary
The post announces CVE‑2026‑30854 – a moderate‑severity GraphQL introspection bypass on Parse Server via inline fragments, with no evidence of PoC, exploit, or mitigation.
CVE-2026-30854 GraphQL Introspection Bypass Vulnerability in Parse Server Alpha Versions https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-30854
Post summary
CVE-2026-30854 is announced as a GraphQL introspection bypass affecting Parse Server alpha releases, but no PoC, exploit, or mitigation details are provided.
CVE-2026-30854 Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. From version 9.3.1-alpha.3 to before version 9.5.0-alpha.10, w… https://www.cve.org/CVERecord?id=CVE-2026-30854
Post summary
The provided text only states the CVE identifier, affected Parse Server versions, and links to a CVE record, without any additional details or actionable information.
12 of 12 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | parseplatform | parse-server | - | node.js | - |
| App | parseplatform | parse-server | 9.3.1 | node.js | - |
| App | parseplatform | parse-server | 9.3.1 | node.js | - |
| App | parseplatform | parse-server | 9.5.0 | node.js | - |
| App | parseplatform | parse-server | 9.5.0 | node.js | - |
| App | parseplatform | parse-server | 9.5.0 | node.js | - |
| App | parseplatform | parse-server | 9.5.0 | node.js | - |
| App | parseplatform | parse-server | 9.5.0 | node.js | - |
| App | parseplatform | parse-server | 9.5.0 | node.js | - |
| App | parseplatform | parse-server | 9.5.0 | node.js | - |
| App | parseplatform | parse-server | 9.5.0 | node.js | - |
| App | parseplatform | parse-server | 9.5.0 | node.js | - |