CVE-2026-116164: Parse Server reserved field name injection in object writes

CVE-2026-116164 · Severity: info · Published 2026-10-25

Parse Server, which manages backend data for mobile and web applications, does not validate reserved internal field names when clients write object data. An attacker can write these reserved fields to corrupt objects on MongoDB databases, breaking queries for all users, or modify their own account to bypass security lockouts and password policies.

Technologies: Parse Community Parse Server. Vendors: Parse Community.

Quick answers

Is CVE-2026-116164 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-116164 being exploited in the wild.
How severe is CVE-2026-116164?
Informational severity, published 25 October 2026.
Which products and versions are affected?
Parse Community Parse Server <8.6.100, >=9.0.0 <9.10.4-alpha.3.
Is there a fix for CVE-2026-116164?
Yes: fixed in Parse Server 8.6.100, 9.10.4-alpha.3. Until then: Register an empty beforeSave Cloud Code trigger for every class that clients can write to, including the _User class, which causes Parse Server to discard reserved field names from client requests. For existing corrupted objects, manually remove the unexpected internal field directly from the MongoDB database. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116164 attacked?
It is attacked over the network.
Am I affected by CVE-2026-116164?
Check whether you run Parse Community Parse Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: Parse Server 8.6.100, 9.10.4-alpha.3

Register an empty beforeSave Cloud Code trigger for every class that clients can write to, including the _User class, which causes Parse Server to discard reserved field names from client requests. For existing corrupted objects, manually remove the unexpected internal field directly from the MongoDB database.

Technical details

Parse Server fails to reject reserved internal field names in client object write operations (CWE-20 improper input validation). On MongoDB deployments, clients with write permissions can inject reserved fields causing subsequent object reads to fail, disrupting class-wide queries; on both MongoDB and PostgreSQL, users can clear internal fields like account lockout counters and password history on their own account records to circumvent security controls.

Affected products

  • Parse Community Parse Server <8.6.100, >=9.0.0 <9.10.4-alpha.3

Timeline

  • 2026-10-08: disclosed
  • 2026-10-25: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.