CVE-2026-32594: Parse Server Auth Bypass Vulnerability

CVE-2026-32594 Overview

Parse Server, an open source backend that can be deployed to any infrastructure running Node.js, contains an authentication bypass vulnerability in its GraphQL WebSocket endpoint. Prior to versions 8.6.40 and 9.6.0-alpha.14, the GraphQL WebSocket endpoint for subscriptions does not pass requests through the Express middleware chain that enforces authentication, introspection control, and query complexity limits. This allows attackers to bypass critical security controls that should protect GraphQL operations.

Critical Impact

Unauthenticated attackers can execute arbitrary GraphQL operations, access schema information via introspection even when disabled, and send complex queries that bypass configured limits, potentially leading to information disclosure and denial of service.

Affected Products

• Parse Server versions prior to 8.6.40
• Parse Server 9.6.0-alpha.1 through 9.6.0-alpha.13
• parseplatform parse-server for Node.js

Discovery Timeline

• March 16, 2026 - CVE-2026-32594 published to NVD
• March 17, 2026 - Last updated in NVD database

Technical Details for CVE-2026-32594

Vulnerability Analysis

This vulnerability stems from an architectural oversight where the GraphQL WebSocket subscription endpoint bypasses the standard Express middleware security chain. When Parse Server processes GraphQL requests via the WebSocket protocol, the authentication middleware, introspection controls, and query complexity validators are not invoked. This creates a direct pathway for attackers to interact with the GraphQL API without proper authorization checks.

The vulnerability is classified under CWE-306 (Missing Authentication for Critical Function), as the WebSocket endpoint fails to enforce the same authentication requirements applied to standard HTTP-based GraphQL requests. Attackers can exploit this gap to perform three distinct attack scenarios: executing GraphQL operations without valid application or API keys, accessing the GraphQL schema via introspection even when public introspection is administratively disabled, and submitting arbitrarily complex queries that would normally be rejected by configured complexity limits.

Root Cause

The root cause is the architectural separation between HTTP request handling and WebSocket connection handling in Parse Server's GraphQL implementation. While HTTP requests are routed through Express middleware that enforces authentication and other security policies, WebSocket connections establish a persistent connection that bypasses this middleware chain entirely. The WebSocket endpoint was implemented without equivalent security controls, leaving it exposed to unauthenticated access.

Attack Vector

The attack vector is network-based and requires no user interaction or prior authentication. An attacker can establish a WebSocket connection to the Parse Server GraphQL subscription endpoint and immediately begin executing GraphQL operations. The attack can be conducted remotely without any privileges, as the authentication mechanism is entirely bypassed.

The exploitation workflow involves connecting to the WebSocket endpoint (typically /graphql with WebSocket upgrade), then sending GraphQL subscription queries or mutations directly through the WebSocket channel. Since the middleware chain is bypassed, operations that should require API keys or application credentials execute successfully without authentication.

Detection Methods for CVE-2026-32594

Indicators of Compromise

• Unexpected WebSocket connections to the GraphQL endpoint from unauthorized IP addresses or without valid authentication headers
• GraphQL introspection queries executed when introspection should be disabled
• Unusually complex GraphQL queries that exceed configured complexity thresholds
• High volume of GraphQL subscription requests from single sources without corresponding authentication events

Detection Strategies

• Monitor WebSocket connection logs for GraphQL endpoints and correlate with authentication events to identify unauthenticated sessions
• Implement network-level monitoring to detect WebSocket upgrade requests to Parse Server GraphQL endpoints
• Review GraphQL query logs for introspection queries (__schema, __type) that should be blocked by policy
• Deploy application-level logging to track GraphQL operations executed via WebSocket connections

Monitoring Recommendations

• Enable detailed logging for all GraphQL WebSocket connections including source IP, connection duration, and operations performed
• Set up alerts for GraphQL introspection attempts when introspection is configured as disabled
• Monitor for queries with complexity scores exceeding organizational thresholds
• Implement connection rate limiting on WebSocket endpoints to detect potential abuse

How to Mitigate CVE-2026-32594

Immediate Actions Required

• Upgrade Parse Server to version 8.6.40 or later for the stable branch
• Upgrade Parse Server to version 9.6.0-alpha.14 or later for the alpha branch
• Review GraphQL WebSocket access logs for any signs of exploitation
• Temporarily disable GraphQL WebSocket subscriptions if upgrading is not immediately possible

Patch Information

The Parse Community has released security patches addressing this vulnerability. The fixes ensure that WebSocket connections to the GraphQL endpoint are properly routed through the Express middleware chain, enforcing authentication, introspection controls, and query complexity limits. Detailed patch information is available in GitHub Pull Request #10189 for the stable branch and GitHub Pull Request #10190 for the alpha branch. The complete security advisory is documented at GitHub Security Advisory GHSA-p2x3-8689-cwpg.

Workarounds

• Disable GraphQL WebSocket subscriptions entirely by removing or restricting access to the subscription endpoint until patching is possible
• Implement network-level access controls (firewall rules, reverse proxy configuration) to restrict WebSocket connections to trusted sources only
• Deploy a Web Application Firewall (WAF) with WebSocket inspection capabilities to filter unauthorized GraphQL operations
• Use network segmentation to limit exposure of Parse Server GraphQL endpoints to internal networks only

# Example: Restrict WebSocket access via nginx reverse proxy
# Add to nginx server block configuration
location /graphql {
    # Block WebSocket upgrades until patch is applied
    if ($http_upgrade = "websocket") {
        return 403;
    }
    proxy_pass http://parse-server:1337;
}