PT-2026-25374 · Unknown+1 · Parse Server+1

Fancymalware · Publicado 2026-03-13 · Atualizado 2026-03-20 · CVE-2026-32594

Positive Technologies (AI Summary)

CVSS v3.1

7.3

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.40 Parse Server versions prior to 9.6.0-alpha.14

Description Parse Server, an open-source backend deployable on Node.js infrastructures, is affected by an issue in the GraphQL WebSocket endpoint for subscriptions. Prior to fixes, this endpoint did not enforce authentication, introspection control, or query complexity limits through the standard Express middleware chain. This allowed attackers to connect to the WebSocket endpoint and execute GraphQL operations without valid API keys, access the GraphQL schema even with public introspection disabled, and bypass query complexity limits by sending arbitrarily complex queries.

Recommendations Versions prior to 8.6.40 should be updated to version 8.6.40 or later. Versions prior to 9.6.0-alpha.14 should be updated to version 9.6.0-alpha.14 or later. Block WebSocket upgrade requests to the GraphQL subscriptions path (by default /subscriptions) at the network level, for example using a reverse proxy or load balancer rule.

Exploit

Correção

Missing Authentication

Enumeração de Fraquezas

CWE-306

Identificadores relacionados

BIT-PARSE-2026-32594

CVE-2026-32594

GHSA-P2X3-8689-CWPG

Produtos afetados

Node.Js

Parse Server

Referências · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32594.json · Exploit
• https://github.com/parse-community/parse-server/pull/10190 · Correção
• https://github.com/parse-community/parse-server/security/advisories/GHSA-p2x3-8689-cwpg · Aviso do Fabricante
• https://github.com/parse-community/parse-server/pull/10189 · Correção
• https://github.com/parse-community/parse-server · Nota
• https://github.com/parse-community/parse-server/commit/21330d146c68b57a930a58b8a8cd9fbf09436cf3 · Nota
• https://github.com/parse-community/parse-server/commit/3ffba757bfc836bd034e1369f4f64304e110e375 · Nota
• https://osv.dev/vulnerability/CVE-2026-32594 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-p2x3-8689-cwpg · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2032605874485661967 · Publicação no Twitter
• https://osv.dev/vulnerability/BIT-parse-2026-32594 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-32594 · Nota de Segurança