6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-30854

CVE-2026-30854: Parse Server: GraphQL `__type` introspection bypass via inline fragments when public introspection is disabled

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. From version 9.3.1-alpha.3 to before version 9.5.0-alpha.10, when graphQLPublicIntrospection is disabled, __type queries nested inside inline fragments (e.g. ... on Query { __type(name:"User") { name } }) bypass the introspection control, allowing unauthenticated users to perform type reconnaissance. __schema introspection is not affected. This issue has been patched in version 9.5.0-alpha.10.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-30854

CVE-2026-30854:

6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
parse-server	npm	>= 9.3.1-alpha.3, < 9.5.0-alpha.10	9.5.0-alpha.10

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The security vulnerability allows unauthorized users to bypass GraphQL introspection controls by nesting __type queries inside inline fragments. The analysis of the provided patch commit f17d506c2891b80ccff60ec3ad33c4db73601b20 reveals that the core of the vulnerability is in the hasTypeIntrospection function located in src/GraphQL/ParseGraphQLServer.js. The original code performed a shallow check on the query's abstract syntax tree (AST), only looking for __type fields at the root of the query. The patch replaces this logic with a recursive traversal of the query's selection sets, ensuring that any instance of the __type field is found, regardless of its depth or nesting within fragments. Therefore, hasTypeIntrospection is the vulnerable function, as its flawed implementation is the direct cause of the security issue. During an exploit, this function would be called to validate the incoming GraphQL query, and its failure to properly detect the nested introspection query would allow the unauthorized access to proceed.

Vulnerable functions

hasTypeIntrospection

src/GraphQL/ParseGraphQLServer.js

The vulnerability lies in the `hasTypeIntrospection` function, which was intended to block GraphQL introspection queries. The original implementation only checked for the `__type` field at the top level of the query. An attacker could bypass this check by nesting the `__type` field within an inline fragment (`... on Query { ... }`). The patch fixes this by implementing a recursive check (`checkSelections`) that traverses the entire query structure, ensuring that nested `__type` fields are also detected.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.