CVE-2026-30938
Logic Bug Allows requestKeywordDenylist Bypass in Parse Server
Publication date: 2026-03-10
Last updated on: 2026-03-11
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| parseplatform | parse-server | From 9.0.0 (inc) to 9.5.1 (exc) |
| parseplatform | parse-server | to 8.6.12 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-693 | The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': "CVE-2026-30938 is a vulnerability in the Parse Server's requestKeywordDenylist feature, which is designed to block requests containing prohibited keywords."}, {'type': 'paragraph', 'content': 'Due to a logic bug, the denylist scanning can be bypassed by placing any nested object or array before a forbidden keyword in the request payload. This happens because the scanning logic stops checking sibling keys after encountering the first nested value, allowing attackers to evade detection.'}, {'type': 'paragraph', 'content': 'This bypass applies to all custom denylist entries configured by developers and affects all Parse Server deployments with the denylist enabled by default.'}, {'type': 'paragraph', 'content': 'The vulnerability was fixed in Parse Server versions 8.6.12 and 9.5.1-alpha.1 by improving the scanning logic to properly inspect nested objects.'}] [1, 2, 3]
How can this vulnerability impact me? :
This vulnerability allows attackers to bypass keyword-based denylist filters, potentially enabling them to send requests containing prohibited keywords that would otherwise be blocked.
Because the vulnerability can be exploited remotely without any privileges or user interaction, it poses a risk of unauthorized modification of system data (integrity impact).
There is no impact on confidentiality or availability, but the integrity of data handled by Parse Server can be compromised.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate the CVE-2026-30938 vulnerability in Parse Server, immediately upgrade your Parse Server deployment to version 8.6.12 or later, or 9.5.1-alpha.1 or later, where the issue with the requestKeywordDenylist bypass has been fixed.
As an additional mitigation, implement a Cloud Code beforeSave trigger to validate incoming data for prohibited keywords across all classes, ensuring that requests containing forbidden keywords are blocked even if the denylist bypass is attempted.