CVE-2026-33429

Description

### Impact An attacker can subscribe to LiveQuery with a `watch` parameter targeting a protected field. Although the protected field value is properly stripped from event payloads, the presence or absence of update events reveals whether the protected field changed, creating a binary oracle. For boolean protected fields, the timing of change events is equivalent to knowing the field value. ### Patches The `watch` parameter is now validated against protected fields at subscription time, mirroring the existing validation for the `where` clause. Subscriptions that include protected fields in `watch` are rejected with a permission error. Master key connections are exempt. ### Workarounds None.

How to fix CVE-2026-33429

To remediate CVE-2026-33429, upgrade the affected package to a fixed version below.

• —upgrade to 8.6.54 or later
• —upgrade to 9.6.0-alpha.43 or later

Is CVE-2026-33429 being exploited?

Low — EPSS is 0.0%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• from 0, < 8.6.54, >= 9.0.0, < 9.6.0
• >= 9.0.0, < 9.6.0-alpha.43

CVSS scores

References (7)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2026-33429
• PATCHgithub.com/parse-community/parse-server
• WEBgithub.com/parse-community/parse-server/commit/0c0a0a5a37ca821d2553119f2cb3be35322eda4b
• WEBgithub.com/parse-community/parse-server/commit/c62eacaf38de86913f09240583448360b1cc8e67