CVE-2026-29182: Parse Server Auth Bypass Vulnerability

CVE-2026-29182 Overview

CVE-2026-29182 is an Authorization Bypass vulnerability affecting Parse Server, an open source backend that can be deployed to any infrastructure capable of running Node.js. The vulnerability exists in Parse Server's readOnlyMasterKey option, which is designed to allow access with master-level read privileges while denying all write operations. However, certain endpoints incorrectly accept the readOnlyMasterKey for mutating operations, allowing an attacker with knowledge of this key to create, modify, and delete Cloud Hooks and to start Cloud Jobs. This access control flaw can be leveraged for data exfiltration.

Critical Impact
Attackers with the readOnlyMasterKey can bypass authorization controls to perform unauthorized write operations including creating, modifying, and deleting Cloud Hooks and starting Cloud Jobs, potentially leading to data exfiltration.

Affected Products

parseplatform parse-server versions prior to 8.6.4
parseplatform parse-server versions prior to 9.4.1-alpha.3
parseplatform parse-server versions 9.4.1-alpha1 and 9.4.1-alpha2

Discovery Timeline

2026-03-06 - CVE CVE-2026-29182 published to NVD
2026-03-10 - Last updated in NVD database

Technical Details for CVE-2026-29182

Vulnerability Analysis

This vulnerability is classified as CWE-863 (Incorrect Authorization), where the application fails to properly enforce authorization restrictions for the readOnlyMasterKey. The key is intended to provide master-level read access while blocking all write operations. However, certain API endpoints within Parse Server do not properly validate whether the incoming request uses the readOnlyMasterKey versus the full master key, allowing write operations to proceed when they should be denied.

The attack is network-accessible and requires the attacker to possess the readOnlyMasterKey. While this represents a form of privileged access, the security assumption is that holders of this key should only be able to read data. The failure to enforce this restriction at all endpoints creates a significant authorization gap that undermines the security model of the readOnlyMasterKey feature.

Root Cause

The root cause is improper authorization checking at specific API endpoints. When the readOnlyMasterKey feature was implemented, not all mutating endpoints were updated to verify whether the provided key should only grant read access. The affected endpoints for Cloud Hooks management and Cloud Job execution accept the readOnlyMasterKey as if it were a full master key, bypassing the intended read-only restriction.

Attack Vector

The attack vector is network-based, requiring an attacker to have obtained the readOnlyMasterKey for the target Parse Server deployment. With this key, an attacker can make API requests to the vulnerable endpoints to:

Create new Cloud Hooks that execute arbitrary server-side code
Modify existing Cloud Hooks to inject malicious functionality
Delete Cloud Hooks to disrupt application behavior
Start Cloud Jobs that may have access to sensitive data

These capabilities can be chained together to exfiltrate data from the Parse Server backend, as Cloud Hooks and Jobs typically have elevated access to the database and application logic. For detailed technical information regarding exploitation, see the GitHub Security Advisory.

Detection Methods for CVE-2026-29182

Indicators of Compromise

Unexpected creation, modification, or deletion of Cloud Hooks in Parse Server logs
Unauthorized Cloud Job executions that were not initiated by legitimate administrators
API requests to Cloud Hook or Cloud Job endpoints using the readOnlyMasterKey
Unusual data access patterns from Cloud Jobs that may indicate data exfiltration

Detection Strategies

Monitor Parse Server access logs for API calls to /hooks and /jobs endpoints with readOnlyMasterKey authentication
Implement alerting for any Cloud Hook configuration changes outside of approved change windows
Review audit logs for Cloud Job executions that don't correlate with expected application behavior
Deploy network traffic analysis to detect unusual outbound data transfers from the Parse Server instance

Monitoring Recommendations

Enable comprehensive logging for all Parse Server API endpoints, particularly administrative functions
Configure alerts for any modifications to Cloud Hook configurations
Monitor for anomalous Cloud Job execution patterns or frequencies
Implement SentinelOne Singularity for endpoint detection to identify suspicious Node.js process behavior

How to Mitigate CVE-2026-29182

Immediate Actions Required

Upgrade Parse Server to version 8.6.4 or 9.4.1-alpha.3 immediately
Rotate the readOnlyMasterKey if there is any suspicion it may have been exposed or misused
Audit Cloud Hooks and Cloud Jobs for any unauthorized modifications
Review access logs for the readOnlyMasterKey to identify potential exploitation attempts
Temporarily disable the readOnlyMasterKey feature if upgrading is not immediately possible

Patch Information

Parse Server has released security patches addressing this vulnerability in versions 8.6.4 and 9.4.1-alpha.3. These patches ensure that all mutating endpoints properly validate whether the provided authentication key should only grant read access.

Parse Server Release 8.6.4 - Stable release with the security fix
Parse Server Release 9.4.1-alpha.3 - Alpha release with the security fix for users on the 9.x branch

For complete details on the vulnerability and patch, see the GitHub Security Advisory GHSA-vc89-5g3r-cmhh.

Workarounds

If upgrading is not immediately feasible, consider disabling the readOnlyMasterKey feature entirely until the patch can be applied
Implement network-level access controls to restrict which systems can reach Cloud Hook and Cloud Job management endpoints
Deploy a reverse proxy or API gateway to filter requests to sensitive endpoints and block unauthorized write operations
Monitor and audit all Cloud Hook and Cloud Job activity manually until the patched version is deployed

bash

# Example: Update Parse Server using npm
npm update parse-server@8.6.4

# Or for the alpha branch
npm update parse-server@9.4.1-alpha.3