https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-16T03:06:47.167796+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-parse-2026-30854 BIT-parse-2026-30854 — Parse Server: GraphQL `__type` introspection bypass via inline fragments when public introspection is disabled 2026-10-16T03:06:47.202227+00:00

Affected: Bitnami: parse

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. From version 9.3.1 to before version 9.5.0, when graphQLPublicIntrospection is disabled, __type queries nested inside inline fragments (e.g. ... on Query { __type(name:"User") { name } }) bypass the introspection control, allowing unauthenticated users to perform type reconnaissance. __schema introspection is not affected. This issue has been patched in version 9.5.0.

 https://cve.radiocsirt.org/vuln/euvd-2026-274996 EUVD-2026-274996 2026-10-16T03:06:47.202283+00:00 EUVD-2026-274996 https://cve.radiocsirt.org/vuln/fkie_cve-2026-30854 fkie_cve-2026-30854 2026-10-16T03:06:47.202299+00:00

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. From version 9.3.1-alpha.3 to before version 9.5.0-alpha.10, when graphQLPublicIntrospection is disabled, __type queries nested inside inline fragments (e.g. ... on Query { __type(name:"User") { name } }) bypass the introspection control, allowing unauthenticated users to perform type reconnaissance. __schema introspection is not affected. This issue has been patched in version 9.5.0-alpha.10.

 https://cve.radiocsirt.org/vuln/ghsa-q5q9-2rhp-33qw GHSA-q5q9-2rhp-33qw — Parse Server: GraphQL `__type` introspection bypass via inline fragments when public introspection is disabled 2026-10-16T03:06:47.202325+00:00

Affected: npm: parse-server

### Impact

When `graphQLPublicIntrospection` is disabled, `__type` queries nested inside inline fragments (e.g. `... on Query { __type(name:"User") { name } })` bypass the introspection control, allowing unauthenticated users to perform type reconnaissance. `__schema` introspection is not affected.

### Patches

The check was changed from a flat iteration over root-level selections to a recursive walk of all selection sets, detecting `__type` inside inline fragments at any depth.

### Workarounds

Require master key authentication at the network layer (e.g. reverse proxy) for the GraphQL endpoint.

### References

- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-q5q9-2rhp-33qw - Fix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.5.0-alpha.10