8.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-29182

CVE-2026-29182: Parse Server: Cloud Hooks and Cloud Jobs bypass `readOnlyMasterKey` write restriction

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.4 and 9.4.1-alpha.3, Parse Server's readOnlyMasterKey option allows access with master-level read privileges but is documented to deny all write operations. However, some endpoints incorrectly accept the readOnlyMasterKey for mutating operations. This allows a caller who only holds the readOnlyMasterKey to create, modify, and delete Cloud Hooks and to start Cloud Jobs, which can be used for data exfiltration. Any Parse Server deployment that uses the readOnlyMasterKey option is affected. Note than an attacker needs to know the readOnlyMasterKey to exploit this vulnerability. This issue has been patched in versions 8.6.4 and 9.4.1-alpha.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-29182

CVE-2026-29182:

8.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
parse-server	npm	>= 9.0.0, <= 9.4.1-alpha.2	9.4.1-alpha.3
parse-server	npm	<= 8.6.3	8.6.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in several router handler functions within Parse Server that failed to enforce the readOnlyMasterKey restriction. The description states that readOnlyMasterKey should deny all write operations, but certain endpoints for Cloud Hooks and Cloud Jobs did not perform this check. By analyzing the patch 6c79da91fc5ec6f2a0bb69a0ca6a886c1585754f, I identified the exact locations where the authorization checks were missing. The patch adds a conditional check if (req.auth.isReadOnly) at the beginning of the handleCloudJob function in src/Routers/FunctionsRouter.js, and the handlePost and handlePut functions in src/Routers/HooksRouter.js. Before the patch, these functions would proceed with creating, updating, deleting, or running jobs/hooks even when the request was authenticated with the read-only key. Therefore, these three functions are the vulnerable functions that would appear in a runtime profile during exploitation.

Vulnerable functions

FunctionsRouter.handleCloudJob

src/Routers/FunctionsRouter.js

The `handleCloudJob` function in `FunctionsRouter.js` did not check if the master key was read-only before allowing a job to be started. An attacker with the `readOnlyMasterKey` could start a Cloud Job, which could be used for data exfiltration or other malicious activities. The patch adds a check `req.auth.isReadOnly` to prevent this.

HooksRouter.handlePost

src/Routers/HooksRouter.js

The `handlePost` function in `HooksRouter.js` did not verify if the master key was read-only before creating a new Cloud Hook. This allowed an attacker with the `readOnlyMasterKey` to create arbitrary hooks, potentially leading to data exfiltration or unauthorized actions. The fix introduces a check `req.auth.isReadOnly` to block this operation.

HooksRouter.handlePut

src/Routers/HooksRouter.js

The `handlePut` function in `HooksRouter.js` was missing an authorization check to prevent modifications or deletions of Cloud Hooks using the `readOnlyMasterKey`. This allowed an attacker with this key to update or delete existing hooks. The patch adds the `req.auth.isReadOnly` check to enforce the write restriction.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.