CVE-2026-30854

Description

### Impact When `graphQLPublicIntrospection` is disabled, `__type` queries nested inside inline fragments (e.g. `... on Query { __type(name:"User") { name } })` bypass the introspection control, allowing unauthenticated users to perform type reconnaissance. `__schema` introspection is not affected. ### Patches The check was changed from a flat iteration over root-level selections to a recursive walk of all selection sets, detecting `__type` inside inline fragments at any depth. ### Workarounds Require master key authentication at the network layer (e.g. reverse proxy) for the GraphQL endpoint. ### References - GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-q5q9-2rhp-33qw - Fix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.5.0-alpha.10

How to fix CVE-2026-30854

To remediate CVE-2026-30854, upgrade the affected package to a fixed version below.

• —upgrade to 9.5.0 or later
• —upgrade to 9.5.0-alpha.10 or later

Is CVE-2026-30854 being exploited?

Low — EPSS is 0.0%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• >= 9.3.1, < 9.5.0
• >= 9.3.1-alpha.3, < 9.5.0-alpha.10

CVSS scores

References (3)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2026-30854
• PATCHgithub.com/parse-community/parse-server
• WEBgithub.com/parse-community/parse-server/security/advisories/GHSA-q5q9-2rhp-33qw