CVE-2026-34595

🗓️ 31 Mar 2026 15:10:06Reported by GitHub_MType

CVE-2026-34595 allows bypassing LiveQuery protectedFields via array-like operator objects.

Reporter	Title	Published	Views	Family All 16
ATTACKERKB	CVE-2026-34595	31 Mar 202615:10	–	attackerkb
CNNVD	Parse Server 安全漏洞	31 Mar 202600:00	–	cnnvd
Cvelist	CVE-2026-34595 Parse Server: LiveQuery protected-field guard bypass via array-like logical operator value	31 Mar 202615:10	–	cvelist
EUVD	EUVD-2026-17504	1 Apr 202600:07	–	euvd
Github Security Blog	Parse Server has a LiveQuery protected-field guard bypass via array-like logical operator value	1 Apr 202600:07	–	github
NVD	CVE-2026-34595	31 Mar 202616:16	–	nvd
OSV	BIT-PARSE-2026-34595 Parse Server: LiveQuery protected-field guard bypass via array-like logical operator value	6 Apr 202614:49	–	osv
OSV	CVE-2026-34595 Parse Server: LiveQuery protected-field guard bypass via array-like logical operator value	31 Mar 202615:10	–	osv
OSV	GHSA-MMG8-87C5-JRC2 Parse Server has a LiveQuery protected-field guard bypass via array-like logical operator value	1 Apr 202600:07	–	osv
Positive Technologies	PT-2026-29279	31 Mar 202600:00	–	ptsecurity

NVD

Vulners

Node

parseplatform parse-serverRange<8.6.70node.js

parseplatform parse-serverRange9.0.0–9.7.0node.js

parseplatform parse-serverMatch9.7.0alpha1node.js

parseplatform parse-serverMatch9.7.0alpha10node.js

parseplatform parse-serverMatch9.7.0alpha11node.js

parseplatform parse-serverMatch9.7.0alpha12node.js

parseplatform parse-serverMatch9.7.0alpha13node.js

parseplatform parse-serverMatch9.7.0alpha14node.js

parseplatform parse-serverMatch9.7.0alpha15node.js

parseplatform parse-serverMatch9.7.0alpha2node.js

parseplatform parse-serverMatch9.7.0alpha3node.js

parseplatform parse-serverMatch9.7.0alpha4node.js

parseplatform parse-serverMatch9.7.0alpha5node.js

parseplatform parse-serverMatch9.7.0alpha6node.js

parseplatform parse-serverMatch9.7.0alpha7node.js

parseplatform parse-serverMatch9.7.0alpha8node.js

parseplatform parse-serverMatch9.7.0alpha9node.js

[
  {
    "vendor": "parse-community",
    "product": "parse-server",
    "versions": [
      {
        "version": "< 8.6.70",
        "status": "affected"
      },
      {
        "version": ">= 9.0.0, < 9.7.0-alpha.18",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/parse-community/parse-server/pull/10350
github	www.github.com/parse-community/parse-server/commit/f63fd1a3fe0a7c1c5fe809f01b0e04759e8c9b98
github	www.github.com/parse-community/parse-server/commit/ffad0ec6b971ee0dd9545e1bf1fb34ddebf275c2
github	www.github.com/parse-community/parse-server/pull/10351
github	www.github.com/parse-community/parse-server/security/advisories/GHSA-mmg8-87c5-jrc2

02 Apr 2026 17:12Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.14.3

CVSS 45.3

EPSS0.00035

SSVC

CWE-843