CVE-2026-29182: 
JavaScript vulnerability analysis and mitigation

CVE-2026-29182 is an incorrect authorization vulnerability in Parse Server (npm package parse-server) where the readOnlyMasterKey option fails to enforce its documented write-restriction on Cloud Hooks and Cloud Jobs endpoints. Discovered and disclosed on March 4, 2026, it affects all Parse Server versions prior to 8.6.4 and versions 9.0.0 through 9.4.1-alpha.2. Patches were released simultaneously with disclosure. It carries a CVSS v3.1 base score of 7.2 (High) and a CVSS v4.0 base score of 8.6 (High) (GitHub Advisory, Parse Server Advisory).

The root cause is CWE-863 (Incorrect Authorization): Parse Server's authorization logic fails to check whether a request is authenticated with the readOnlyMasterKey before allowing mutating operations on Cloud Hooks and Cloud Jobs endpoints. The readOnlyMasterKey is intended to grant only master-level read access, but the affected endpoints do not enforce this restriction, accepting the key for create, modify, delete, and job-trigger operations. An attacker must already possess the readOnlyMasterKey value (a high-privilege precondition) and can then send crafted HTTP requests to the Cloud Hooks or Cloud Jobs API endpoints to perform unauthorized write operations. The fix adds explicit authorization checks that reject mutating requests authenticated with the readOnlyMasterKey (GitHub Advisory, Parse Server Advisory).

An attacker with knowledge of the readOnlyMasterKey can create, modify, and delete Cloud Hooks and trigger Cloud Jobs on any affected Parse Server deployment, enabling data exfiltration, execution of malicious server-side logic, or denial of service. The vulnerability has high impact across confidentiality, integrity, and availability within the vulnerable system scope. Because Cloud Jobs and Cloud Hooks can interact with backend data stores and external services, successful exploitation could facilitate broader data compromise or service disruption (GitHub Advisory, Feedly).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of disclosure (Feedly). The EPSS score is approximately 0.023% (7th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to already know the readOnlyMasterKey, which limits the attack surface to scenarios involving key leakage or insider threat.

1. Obtain the readOnlyMasterKey: Acquire the target Parse Server's readOnlyMasterKey through credential leakage, source code exposure, misconfigured environment variables, or insider access.
2. Identify the target endpoint: Locate the Parse Server's Cloud Hooks or Cloud Jobs API endpoints (e.g., POST /hooks/functions, POST /hooks/triggers, or POST /jobs/<jobName>).
3. Craft a mutating request: Construct an HTTP request (e.g., POST /hooks/functions) that includes the readOnlyMasterKey in the X-Parse-Master-Key header and a JSON body defining a new or modified Cloud Hook.
4. Send the request: Submit the request to the vulnerable Parse Server. Due to the missing authorization check, the server incorrectly accepts the readOnlyMasterKey for the write operation and creates or modifies the Cloud Hook.
5. Leverage for data exfiltration or code execution: Use the newly created or modified Cloud Hook or triggered Cloud Job to exfiltrate data, execute arbitrary server-side logic, or disrupt service availability (GitHub Advisory, Parse Server Advisory).

• Network: Unexpected POST, PUT, or DELETE HTTP requests to Cloud Hooks endpoints (e.g., /hooks/functions, /hooks/triggers) or Cloud Jobs endpoints (e.g., /jobs/<jobName>) authenticated with the X-Parse-Master-Key header from unusual source IPs or at unusual times.
• Logs: Parse Server access logs showing mutating operations (POST/PUT/DELETE) on /hooks/ or /jobs/ paths using the readOnlyMasterKey; unexpected Cloud Job execution entries in server logs.
• Application State: Unexpected or newly created Cloud Hooks or Cloud Jobs not matching known configurations; modifications to existing Cloud Hook URLs pointing to external or unknown endpoints.
• Process/Behavior: Unusual outbound network connections from the Parse Server process to external hosts, potentially indicating data exfiltration via a malicious Cloud Hook or Job.

Upgrade Parse Server to version 8.6.4 (stable) or 9.4.1-alpha.3 (pre-release) or later, which add proper authorization checks rejecting mutating requests made with the readOnlyMasterKey (Parse Server 8.6.4 Release, Parse Server 9.4.1-alpha.3 Release). There is no known configuration-based workaround; if immediate upgrade is not possible, ensure the readOnlyMasterKey value is not shared with any untrusted parties and treat it as a highly sensitive credential (GitHub Advisory). Additionally, monitor Cloud Hooks and Cloud Jobs configurations for unauthorized changes as a compensating control.

The vulnerability was coordinated and published by Parse Server maintainer mtrezza, with devanshbatham credited as finder and asukachloe as reporter (Parse Server Advisory). Community coverage appeared on security aggregator sites and blogs shortly after disclosure, including a write-up on the CVE-2026 Parse Server series (undercodetesting.com) and researcher blog posts (devansh.bearblog.dev). Red Hat also tracked the advisory (Red Hat CVE). Overall community reaction was measured, consistent with a vulnerability requiring prior credential knowledge.