CVE-2026-29182 Details
Description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.4 and 9.4.1-alpha.3, Parse Server's readOnlyMasterKey option allows access with master-level read privileges but is documented to deny all write operations. However, some endpoints incorrectly accept the readOnlyMasterKey for mutating operations. This allows a caller who only holds the readOnlyMasterKey to create, modify, and delete Cloud Hooks and to start Cloud Jobs, which can be used for data exfiltration. Any Parse Server deployment that uses the readOnlyMasterKey option is affected. Note than an attacker needs to know the readOnlyMasterKey to exploit this vulnerability. This issue has been patched in versions 8.6.4 and 9.4.1-alpha.3.
A vulnerability in Parse Server prior to versions 8.6.4 and 9.4.1-alpha.3 allows the readOnlyMasterKey to be used for unauthorized write operations. This issue affects any Parse Server deployment that utilizes the readOnlyMasterKey option. While the readOnlyMasterKey is intended to grant master-level read privileges without allowing writes, certain endpoints incorrectly permit mutating actions. As a result, an individual with knowledge of the readOnlyMasterKey can create, modify, and delete Cloud Hooks, initiate Cloud Jobs, and potentially exfiltrate data.
Users can upgrade to Parse Server versions 8.6.4 or 9.4.1-alpha.3 to address this vulnerability. If an immediate upgrade is not possible, it is recommended to avoid sharing the readOnlyMasterKey with untrusted parties.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/parse-community/parse-server/releases/tag/8.6.4 | [email protected] | PatchRelease Notes |
| https://github.com/parse-community/parse-server/releases/tag/9.4.1-alpha.3 | [email protected] | PatchRelease Notes |
| https://github.com/parse-community/parse-server/security/advisories/GHSA-vc89-5g3r-cmhh | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| parseplatform parse-server | < 8.6.4 >= 9.0.0, <= 9.4.0 9.4.1 alpha1 9.4.1 alpha2 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 10, 2026 | Initial Analysis | [email protected] |
| Mar 6, 2026 | New CVE Received | [email protected] |