CVE-2026-32234

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.10 and 8.6.36, an attacker with access to the master key can inject malicious SQL via crafted field names used in query constraints when Parse Server is configured with PostgreSQL as the database. The field name in a $regex query operator is passed to PostgreSQL using unparameterized string interpolation, allowing the attacker to manipulate the SQL query. While the master key controls what can be done through the Parse Server abstraction layer, this SQL injection bypasses Parse Server entirely and operates at the database level. This vulnerability only affects Parse Server deployments using PostgreSQL. This vulnerability is fixed in 9.6.0-alpha.10 and 8.6.36.

• CWE-89

• https://github.com/parse-community/parse-server/releases/tag/8.6.36Product, Release Notes
• https://github.com/parse-community/parse-server/releases/tag/9.6.0-alpha.10Product, Release Notes
• https://github.com/parse-community/parse-server/security/advisories/GHSA-c442-97qw-j6c6Patch, Vendor Advisory

Published

Mar 11, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-32228UI / API User with asset materialize permission could trigge…7.5
• CVE-2026-32229In JetBrains Hub before 2026.1 possible on sign-in account m…6.8
• CVE-2026-3223Arbitrary file write & potential privilege escalation exploi…7.8
• CVE-2026-32230Uptime Kuma is an open source, self-hosted monitoring tool. …5.3
• CVE-2026-32231ZeptoClaw is a personal AI assistant. Prior to 0.7.6, the ge…8.2
• CVE-2026-32232ZeptoClaw is a personal AI assistant. Prior to 0.7.6, there …9.8
• CVE-2026-32235Backstage is an open framework for building developer portal…4.7
• CVE-2026-32236Backstage is an open framework for building developer portal…7.5
• CVE-2026-32237Backstage is an open framework for building developer portal…6.5
• CVE-2026-32238OpenEMR is a free and open source electronic health records …9.1
• CVE-2026-32239Cap'n Proto is a data interchange format and capability-base…6.5
• CVE-2026-3224Authentication bypass in the Microsoft Entra ID (Azure AD) a…9.8