Executive brief
Parse Server is a backend platform that allows developers to build applications with a database backend. When configured with PostgreSQL, an attacker with access to the master key can inject malicious SQL commands through specially crafted field names in database queries. This allows attackers to bypass Parse Server's security controls and directly access or manipulate data in the PostgreSQL database.
Technical details
The vulnerability is a SQL injection (CWE-89) in Parse Server's query handler affecting PostgreSQL deployments. The field name in $regex query operators is passed to PostgreSQL using unparameterized string interpolation, allowing attackers to inject arbitrary SQL. Exploitation requires the attacker to have access to the master key and the Parse Server instance must be configured with PostgreSQL as its database backend. An attacker can execute arbitrary SQL queries at the database level, bypassing Parse Server's abstraction layer protections. Patches are available in Parse Server 9.6.0-alpha.10 (9.x branch) and 8.6.36 (8.x branch), which apply proper SQL identifier escaping and harden field name validation.
Affected products
- Parse Community Parse Server All versions prior to 8.6.36; 9.0.0 through 9.6.0-alpha.10 (prior to fix)
Timeline
- 2026-03-11: disclosed: CVE-2026-32234 published on NVD; GitHub security advisory GHSA-c442-97qw-j6c6 released
- 2026-03-12: patched: Parse Server 8.6.36 and 9.6.0-alpha.10 released with fixes