CVE-2026-29182

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-29182", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-04T14:44:00.713Z", "datePublished": "2026-03-06T20:24:10.802Z", "dateUpdated": "2026-03-09T20:34:21.169Z"}, "containers": {"cna": {"title": "Parse Server: Cloud Hooks and Cloud Jobs bypass `readOnlyMasterKey` write restriction", "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.6, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/parse-community/parse-server/security/advisories/GHSA-vc89-5g3r-cmhh", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-vc89-5g3r-cmhh"}, {"name": "https://github.com/parse-community/parse-server/releases/tag/8.6.4", "tags": ["x_refsource_MISC"], "url": "https://github.com/parse-community/parse-server/releases/tag/8.6.4"}, {"name": "https://github.com/parse-community/parse-server/releases/tag/9.4.1-alpha.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/parse-community/parse-server/releases/tag/9.4.1-alpha.3"}], "affected": [{"vendor": "parse-community", "product": "parse-server", "versions": [{"version": "< 8.6.4", "status": "affected"}, {"version": "< 9.4.1-alpha.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-06T20:24:10.802Z"}, "descriptions": [{"lang": "en", "value": "Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.4 and 9.4.1-alpha.3, Parse Server's readOnlyMasterKey option allows access with master-level read privileges but is documented to deny all write operations. However, some endpoints incorrectly accept the readOnlyMasterKey for mutating operations. This allows a caller who only holds the readOnlyMasterKey to create, modify, and delete Cloud Hooks and to start Cloud Jobs, which can be used for data exfiltration. Any Parse Server deployment that uses the readOnlyMasterKey option is affected. Note than an attacker needs to know the readOnlyMasterKey to exploit this vulnerability. This issue has been patched in versions 8.6.4 and 9.4.1-alpha.3."}], "source": {"advisory": "GHSA-vc89-5g3r-cmhh", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-29182", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-09T20:29:41.548934Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T20:34:21.169Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-29182", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-09T20:29:41.548934Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T20:29:52.688Z"}}], "cna": {"title": "Parse Server: Cloud Hooks and Cloud Jobs bypass `readOnlyMasterKey` write restriction", "source": {"advisory": "GHSA-vc89-5g3r-cmhh", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "parse-community", "product": "parse-server", "versions": [{"status": "affected", "version": "< 8.6.4"}, {"status": "affected", "version": "< 9.4.1-alpha.3"}]}], "references": [{"url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-vc89-5g3r-cmhh", "name": "https://github.com/parse-community/parse-server/security/advisories/GHSA-vc89-5g3r-cmhh", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/parse-community/parse-server/releases/tag/8.6.4", "name": "https://github.com/parse-community/parse-server/releases/tag/8.6.4", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/parse-community/parse-server/releases/tag/9.4.1-alpha.3", "name": "https://github.com/parse-community/parse-server/releases/tag/9.4.1-alpha.3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.4 and 9.4.1-alpha.3, Parse Server's readOnlyMasterKey option allows access with master-level read privileges but is documented to deny all write operations. However, some endpoints incorrectly accept the readOnlyMasterKey for mutating operations. This allows a caller who only holds the readOnlyMasterKey to create, modify, and delete Cloud Hooks and to start Cloud Jobs, which can be used for data exfiltration. Any Parse Server deployment that uses the readOnlyMasterKey option is affected. Note than an attacker needs to know the readOnlyMasterKey to exploit this vulnerability. This issue has been patched in versions 8.6.4 and 9.4.1-alpha.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-06T20:24:10.802Z"}}}, "cveMetadata": {"cveId": "CVE-2026-29182", "state": "PUBLISHED", "dateUpdated": "2026-03-09T20:34:21.169Z", "dateReserved": "2026-03-04T14:44:00.713Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-06T20:24:10.802Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "parse-server", "vendor": "parse-community", "versions": [{"status": "affected", "version": "< 8.6.4"}, {"status": "affected", "version": "< 9.4.1-alpha.3"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "41A471BF-7EE9-4E57-B9F6-1BDB37D27275", "versionEndExcluding": "8.6.4", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "9FF0ADC7-6AA6-44F7-8CA9-E0A2F1C1D63A", "versionEndIncluding": "9.4.0", "versionStartIncluding": "9.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse-server:9.4.1:alpha1:*:*:*:node.js:*:*", "matchCriteriaId": "CC1C695A-70C0-45C8-867F-4541537F370B", "vulnerable": true}, {"criteria": "cpe:2.3:a:parseplatform:parse-server:9.4.1:alpha2:*:*:*:node.js:*:*", "matchCriteriaId": "2B1E392B-A41C-460C-8811-AA0473393870", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.4 and 9.4.1-alpha.3, Parse Server's readOnlyMasterKey option allows access with master-level read privileges but is documented to deny all write operations. However, some endpoints incorrectly accept the readOnlyMasterKey for mutating operations. This allows a caller who only holds the readOnlyMasterKey to create, modify, and delete Cloud Hooks and to start Cloud Jobs, which can be used for data exfiltration. Any Parse Server deployment that uses the readOnlyMasterKey option is affected. Note than an attacker needs to know the readOnlyMasterKey to exploit this vulnerability. This issue has been patched in versions 8.6.4 and 9.4.1-alpha.3."}, {"lang": "es", "value": "Parse Server es un backend de c\u00f3digo abierto que puede ser desplegado en cualquier infraestructura que pueda ejecutar Node.js. Antes de las versiones 8.6.4 y 9.4.1-alpha.3, la opci\u00f3n readOnlyMasterKey de Parse Server permite el acceso con privilegios de lectura a nivel maestro, pero est\u00e1 documentada para denegar todas las operaciones de escritura. Sin embargo, algunos endpoints aceptan incorrectamente la readOnlyMasterKey para operaciones de mutaci\u00f3n. Esto permite a un llamador que solo posee la readOnlyMasterKey crear, modificar y eliminar Cloud Hooks e iniciar Cloud Jobs, lo que puede ser utilizado para la exfiltraci\u00f3n de datos. Cualquier despliegue de Parse Server que utilice la opci\u00f3n readOnlyMasterKey se ve afectado. Tenga en cuenta que un atacante necesita conocer la readOnlyMasterKey para explotar esta vulnerabilidad. Este problema ha sido parcheado en las versiones 8.6.4 y 9.4.1-alpha.3."}], "id": "CVE-2026-29182", "lastModified": "2026-06-17T10:29:44.097", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-29182", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-09T20:29:41.548934Z", "version": "2.0.3"}}]}, "published": "2026-03-06T21:16:15.137", "references": [{"source": "security-advisories@github.com", "tags": ["Patch", "Release Notes"], "url": "https://github.com/parse-community/parse-server/releases/tag/8.6.4"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Release Notes"], "url": "https://github.com/parse-community/parse-server/releases/tag/9.4.1-alpha.3"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-vc89-5g3r-cmhh"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,8.6.4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,9.4.1-alpha.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "parse-server", "source": "cna", "vendor": "parse-community"}, "product": "parse_server", "vendor": "parse_community"}], "analysis": {"en": {"generated_at": "2026-04-17T12:19:02.193892+00:00", "value": {"mitigation_remediation": ["Upgrade Parse Server to version\u202f8.6.4 or\u202f9.4.1\u2011alpha.3 or later, where the flaw is fixed.", "If an upgrade is not immediately possible, disable or remove the readOnlyMasterKey from the configuration and enforce the regular master key for all write operations.", "Restrict or remove existing Cloud Hook and Cloud Job endpoints that allow mutation with readOnlyMasterKey; revoke any hooks or jobs created with the compromised key.", "As a temporary control, isolate the Parse Server behind stricter network boundaries, monitor for suspicious job executions, and rotate authentication keys to limit potential abuse."], "summary": {"action": "Immediate Patch", "impact": "Unauthorized write operations via readOnlyMasterKey leading to potential data exfiltration"}, "threat_synthesis": {"affected_systems": "Any deployment of parse-community:parse-server that uses the readOnlyMasterKey option before the patches. Versions of Parse Server earlier than 8.6.4 and 9.4.1\u2011alpha.3 are affected. The flaw is present in all Node.js environments running those versions.", "description_and_impact": "Parse Server\u2019s readOnlyMasterKey is intended to grant read\u2011only access, yet certain API endpoints incorrectly accept this key for mutating operations. An attacker who knows the key can create, modify, and delete Cloud Hooks and start Cloud Jobs, which can be used to exfiltrate data. This flaw is classified as CWE\u2011863 and results in unauthorized write privileges.", "risk_and_exploitability": "The vulnerability rates a CVSS score of 8.6, indicating high severity. The estimated exploitation probability is below 1\u202f%, suggesting that current exploitation is uncommon, and it is not listed in CISA\u2019s KEV catalog. Nevertheless, the attack vector requires knowledge of the readOnlyMasterKey, which could arise from credential compromise or insider misuse. Once exploited, the attacker gains the ability to alter deployment logic and potentially exfiltrate data, creating a high\u2011impact compromise with moderate likelihood of exploitation."}}}}, "created": "2026-03-09T10:07:04.409797+00:00", "updated": "2026-04-17T12:30:06.221324+00:00", "vendors": ["parse_community", "parse_community$PRODUCT$parse_server"]}