CVE-2026-29182: Parse Server's Cloud Hooks and Jobs Bypass Read-Only Master Key Restrictions
Summary
CVE-2026-29182: Parse Server's Cloud Hooks and Cloud Jobs bypass readOnlyMasterKey write restriction. Affects parse-server across 2 version ranges.
< 8.6.4
>= 9.0.0, < 9.4.1-alpha.3
Fixed in 8.6.4 or 9.4.1-alpha.3, depending on the release line you run. How to fix ↓
Also tracked for
- parse · Bitnami
The same CVE-2026-29182 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Parse Server is an open-source backend platform that enables developers to build applications without needing to manage their own server infrastructure. It provides features such as data storage, user authentication, and cloud functions. The readOnlyMasterKey option is designed to allow read access without write permissions, ensuring that sensitive data remains secure. However, a vulnerability has been identified that undermines this security feature.
Vulnerability Detail
The vulnerability arises from the incorrect implementation of the readOnlyMasterKey option in Parse Server. While this key is intended to restrict write operations, certain endpoints mistakenly accept it for mutating actions. This flaw allows an attacker, who possesses the readOnlyMasterKey, to create, modify, and delete Cloud Hooks and initiate Cloud Jobs, potentially leading to unauthorized data access and exfiltration. Any deployment of Parse Server utilizing the readOnlyMasterKey is susceptible to this issue, provided the attacker knows the key.
How To Fix
Latest published version: 9.10.5 as of 22 Oct 2026
npm install parse-server@9.10.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 8.6.48.6.4npm install parse-server@8.6.4 -
>= 9.0.0, < 9.4.1-alpha.39.4.1-alpha.3npm install parse-server@9.4.1-alpha.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Currently, there are no known workarounds other than upgrading to the patched versions. If immediate upgrading is not feasible, it is crucial to ensure that the readOnlyMasterKey is not shared with untrusted parties to mitigate the risk of exploitation.
Conclusion
The vulnerability identified as CVE-2026-29182 in Parse Server allows unauthorized write operations through the readOnlyMasterKey, posing a significant security risk. It is crucial for users to upgrade to the patched versions to mitigate this risk and ensure the integrity of their applications.
See every vulnerability recorded for parse-server →
FAQ
The readOnlyMasterKey is a special key that allows read access to data without granting write permissions, intended to enhance security.
An attacker who knows the readOnlyMasterKey can perform write operations on Cloud Hooks and Cloud Jobs, leading to potential data breaches.
All versions prior to 9.4.1-alpha.3 and 8.6.4 are affected by this vulnerability.
Yes, you can use Vulert, which monitors your package-lock.json file for open-source vulnerabilities in real-time without requiring code access.
The CVSS score for this vulnerability is 8.6, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for parse-server.
