Parse Dashboard AI Agent Endpoint – Unauthenticated Master Key Access

Product Name: Parse Dashboard
Vendor / Maintainer: Parse Community
Component Affected: AI Agent API endpoint
Endpoint: POST /apps/:appId/agent
Affected Versions: 7.3.0-alpha.42 through 9.0.0-alpha.7
Fixed Version: 9.0.0-alpha.8
Deployment Model: Web-based dashboard used to administer Parse Server backends

Parse Dashboard is widely deployed to manage user accounts, roles, data classes, schema, and operational configurations of Parse Server applications. It is typically trusted and often deployed internally — but in many environments it is exposed to the internet for convenience.

The vulnerability resides in the optional AI Agent feature, which must be explicitly configured to be active. Installations without the agent configuration block are not affected.

Basic CVE Information

Field	Details
CVE ID	CVE-2026-27595
Vulnerability Name	AI Agent Authentication & Authorization Bypass
CVSS v3.1 (Estimated)	9.8 – Critical
Attack Vector	Network
Attack Complexity	Low
Privileges Required	None
User Interaction	None
Scope	Changed
Confidentiality Impact	High
Integrity Impact	High
Availability Impact	High
Exploitability	High
Exploit Availability	Reproducible, PoC patterns publicly discussed
Authentication Required	No
Root Cause	Missing authentication, missing authorization, CSRF absence, key caching flaw

Vulnerability Overview

A critical access control failure was identified in the AI Agent API endpoint of Parse Dashboard. The endpoint was exposed without enforcing authentication or proper authorization checks. As a result, remote attackers were able to submit crafted HTTP requests that were processed internally using the Parse Server master key.

The master key bypasses:

Class-Level Permissions (CLP)
Access Control Lists (ACL)
Role-based restrictions
Object-level security

This effectively grants unrestricted read and write access to all database collections connected to the dashboard.

The issue was compounded by additional flaws:

Absence of authentication middleware on the agent endpoint.
Lack of CSRF validation.
No per-application authorization enforcement.
Cache key collision between masterKey and readOnlyMasterKey, causing privilege confusion.

When chained together, these issues allowed complete database compromise without login credentials.

Technical Root Cause Analysis

1. Missing Authentication

The /apps/:appId/agent route did not validate session cookies or authentication tokens before executing backend logic. Any HTTP client capable of reaching the service could interact with the endpoint.

2. Authorization Bypass

Requests were executed with backend privileges regardless of the identity of the caller. The system failed to confirm whether the caller had rights to interact with the specified application.

3. Master Key Execution Context

The AI agent executed instructions using the Parse Server master key. The master key bypasses all security layers and is designed only for trusted backend operations.

4. Cache Key Collision

A logic flaw caused internal caching of masterKey and readOnlyMasterKey to overlap under certain conditions. In some cases, read-only contexts inherited write privileges.

Exploitation Details (Educational)

Attack Preconditions

Parse Dashboard must be reachable over the network.
AI Agent feature must be enabled in configuration.
No firewall or IP restriction blocking attacker access.

Exploitation Flow

Target dashboard identified via port scanning or web fingerprinting.
AI agent endpoint confirmed accessible.
Crafted JSON payload sent to: POST /apps/<appId>/agent
Backend interprets payload and executes instruction using master key.
Database operations performed with unrestricted privileges.

No credentials, tokens, or prior access required.

Proof-of-Concept Payloads (Educational)

Database Enumeration

POST /apps/app123/agent HTTP/1.1
Host: target.example.com
Content-Type: application/json{
  "message": "Return all objects from _User and _Role collections"
}

Privilege Escalation

{
  "message": "Create new admin user with full permissions"
}

Data Deletion

{
  "message": "Delete all records from all classes"
}

These payload structures demonstrate how instruction-based requests could be leveraged to perform unauthorized database operations.

Impact Assessment

Confidentiality

Exposure of user credentials (hashed)
Extraction of personal data
Disclosure of API keys or tokens stored in database

Integrity

Creation of unauthorized administrative users
Modification of production data
Role manipulation
Schema alteration

Availability

Mass deletion of collections
Corruption of application state
Service outage due to database tampering

Lateral Movement Risk

If credentials or integration tokens were stored in the database, attackers could pivot to:

Third-party services
Authentication systems
Production application environments

MITRE ATT&CK Mapping

Tactic	Technique
Initial Access	Exploit Public-Facing Application
Execution	Command Execution via API
Privilege Escalation	Exploitation for Privilege Escalation
Persistence	Account Manipulation
Credential Access	Data from Information Repositories
Impact	Data Destruction / Manipulation

Detection Strategy

Log Sources Required

Web server access logs (NGINX / Apache)
Parse Dashboard logs
Parse Server application logs
Reverse proxy logs
WAF logs
Database query logs (MongoDB / PostgreSQL)

Indicators of Compromise

POST requests to /apps/*/agent
Requests without authentication headers or session cookies
Unusual spikes in database read volume
Creation of admin users without corresponding login events
Bulk deletion activity
Large HTTP response sizes from agent endpoint

Detection Rules

HTTP Access Monitoring

SELECT *
FROM web_logs
WHERE method = 'POST'
AND uri LIKE '/apps/%/agent%'
AND (session_id IS NULL OR authenticated = false);

Large Response Anomaly

SELECT source_ip, response_size
FROM web_logs
WHERE uri LIKE '/apps/%/agent%'
AND response_size > 1000000;

Unexpected User Creation

SELECT *
FROM database_audit
WHERE collection = '_User'
AND operation = 'INSERT'
AND source_endpoint = '/agent';

Role Escalation Detection

SELECT *
FROM database_audit
WHERE collection = '_Role'
AND operation IN ('INSERT','UPDATE')
AND initiated_by IS NULL;

Forensic Artifacts

Unauthenticated POST requests targeting agent endpoint
Dashboard logs showing agent invocation without user identity
Sudden surge in master key operations
Modifications to _User, _Role, _Session
Changes executed without UI login traces

Remediation

Immediate Actions

Restrict dashboard access to internal network.
Disable AI agent feature.
Rotate:
- Master key
- Read-only master key
- Application secrets
Audit database for unauthorized changes.

Official Patch

Upgrade to:

Parse Dashboard 9.0.0-alpha.8 or later

Official Release Link:
https://github.com/parse-community/parse-dashboard/releases/tag/9.0.0-alpha.8

The patched version introduces:

Mandatory authentication middleware
CSRF validation
Per-application authorization enforcement
Proper privilege separation
Cache key collision correction

Temporary Workaround

Remove or comment out the agent configuration block from the dashboard configuration file and restart the service.

Risk Summary

If deployed publicly with agent enabled, this vulnerability should be treated as equivalent to exposing the master key directly to the internet.

Full backend compromise is possible within a single HTTP request.

Immediate patching is strongly recommended.

CVE-2026-27595: Unauthenticated AI Agent Flaw in Parse Dashboard Exposes Master Key, Enables Full Database Takeover