Detections
Analytics

SCA: security update for parse-server (GHSA-5fw2-8jcv-xh87)

critical Tenable Self-Hosted Container Security Plugin ID 438683

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.
 Prior to 9.6.0-alpha.12 and 8.6.38, an unauthenticated attacker can take over any user account that was
 created with an authentication provider that does not validate the format of the user identifier (e.g.
 anonymous authentication). By sending a crafted login request, the attacker can cause the server to
 perform a pattern-matching query instead of an exact-match lookup, allowing the attacker to match an
 existing user and obtain a valid session token for that user's account. Both MongoDB and PostgreSQL
 database backends are affected. Any Parse Server deployment that allows anonymous authentication (enabled
 by default) is vulnerable. This vulnerability is fixed in 9.6.0-alpha.12 and 8.6.38. (CVE-2026-32248)

Solution

Update the parse-server library and its related packages to version 8.6.38 or later.

See Also

https://github.com/advisories/GHSA-5fw2-8jcv-xh87

Plugin Details

Severity: Critical

ID: 438683

Version: Revision 1.8

Type: Local

Family: SCA Checks

Published: 3/12/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.88

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-32248

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Critical

Base Score: 9.3

Threat Score: 8

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 3/12/2026

Vulnerability Publication Date: 3/12/2026

Reference Information

CVE: CVE-2026-32248

cwe: CWE-943