CVE-2026-33538

Estado: AnalizadaAlta (8.7)—

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.58 and 9.6.0-alpha.52, an unauthenticated attacker can cause denial of service by sending authentication requests with arbitrary, unconfigured provider names. The server executes a database query for each unconfigured provider before rejecting the request, and since no database index exists for unconfigured providers, each request triggers a full collection scan on the user database. This can be parallelized to saturate database resources. This issue has been patched in versions 8.6.58 and 9.6.0-alpha.52.

CVSS

Versión: 4.0
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Puntuación base: 8.7

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.75%
Percentil entre todas las CVEs puntuadas: 54
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1190 Exploit Public-Facing Applicationinitial access95 %
Impacto principalT1499.004 Application or System Exploitationimpact90 %

Acceso de red sin autenticación (AV:N/PR:N/UI:N) explotando Parse Server para provocar DoS mediante consultas masivas a BD (CWE-400: uncontrolled resource consumption).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network Traffic Vulnerability Scanning Privileged Account Management Network Segmentation Limit Access to Resource Over Network Application Isolation and Sandboxing

Tecnologías afectadas (1)

Parseplatform — Parse-server

CWE

CWE-400

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-33538",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-33538",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-03-24T18:37:14.649898Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 8.7,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "HIGH",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "parse-community",
          "product": "parse-server",
          "versions": [
            {
              "status": "affected",
              "version": "< 8.6.58"
            },
            {
              "status": "affected",
              "version": ">= 9.0.0, < 9.6.0-alpha.52"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-03-24T19:16:54.673",
  "references": [
    {
      "url": "https://github.com/parse-community/parse-server/commit/40eb442e02672986730007d0a1edb22c1c4bd357",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/parse-community/parse-server/commit/fbac847499e57f243315c5fc7135be1d58bb8e54",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/parse-community/parse-server/pull/10270",
      "tags": [
        "Issue Tracking"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/parse-community/parse-server/pull/10271",
      "tags": [
        "Issue Tracking"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-g4cf-xj29-wqqr",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.58 and 9.6.0-alpha.52, an unauthenticated attacker can cause denial of service by sending authentication requests with arbitrary, unconfigured provider names. The server executes a database query for each unconfigured provider before rejecting the request, and since no database index exists for unconfigured providers, each request triggers a full collection scan on the user database. This can be parallelized to saturate database resources. This issue has been patched in versions 8.6.58 and 9.6.0-alpha.52."
    },
    {
      "lang": "es",
      "value": "Parse Server es un backend de código abierto que puede ser desplegado en cualquier infraestructura que pueda ejecutar Node.js. Antes de las versiones 8.6.58 y 9.6.0-alpha.52, un atacante no autenticado puede causar denegación de servicio enviando solicitudes de autenticación con nombres de proveedor arbitrarios y no configurados. El servidor ejecuta una consulta de base de datos para cada proveedor no configurado antes de rechazar la solicitud, y dado que no existe un índice de base de datos para proveedores no configurados, cada solicitud desencadena un escaneo completo de la colección en la base de datos de usuarios. Esto puede ser paralelizado para saturar los recursos de la base de datos. Este problema ha sido parcheado en las versiones 8.6.58 y 9.6.0-alpha.52."
    }
  ],
  "lastModified": "2026-06-17T10:37:40.533",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4037DE7F-EB18-4D37-80E1-3FEF4A77D096",
              "versionEndExcluding": "8.6.58"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1BAC01F8-0899-482C-8D91-64671BF2859A",
              "versionEndExcluding": "9.6.0",
              "versionStartIncluding": "9.0.0"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha1:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BBED261F-CA1B-44BC-9C3A-37378590EFEE"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha10:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "418338C9-6AEC-492C-ACA4-9B3C0AAE149C"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha11:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "808B6482-BF8E-407D-8462-E757657CC323"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha12:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B84C28F8-AADE-41BB-A0EF-B701AB57DC3A"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha13:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7567BB81-7837-4265-B792-6A9B73CECF93"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha14:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0035C6F1-21B9-42D1-BE29-690905F3558C"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha15:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "623FB30A-0693-4449-80FA-16D36B1BE66C"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha16:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9B420167-CD3E-45A7-AD9A-0F83AEC634BA"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha17:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "030A8626-DBBD-4BF2-B362-79B44FB1204D"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha18:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D38CFCC3-2AA9-4C8E-9064-FE97E6E8C45C"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha19:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "65BB78F2-3A1A-4CD1-B8A8-4AB043B5CA50"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha2:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EDC98AF7-8620-4A25-9BE5-623672599677"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha20:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "23E28E0F-9379-4628-B9DC-8C94A45902CF"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha21:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6631BE51-74FB-40C0-9E91-0EDF2DCADD7A"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha22:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8B0E4254-14A3-4EB6-9E98-CF45EB08B17F"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha23:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0FF63FDE-75F5-44B6-A958-CF653D84D3B4"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha24:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "252B812D-A162-41C1-91CD-08D0CBAC5C46"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha25:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "421691EA-F55A-4738-8ABD-74B53B6DF155"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha26:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5E7FAB59-142E-4191-9A6F-0744D810CD81"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha27:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B010F310-05A1-48AE-B002-8F4C7FA62EB3"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha28:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4D3B2C32-16D8-415B-A49F-060ECE8F0F33"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha29:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "43BE83C2-C756-4A5A-A340-B7D1FB52078D"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha3:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DF340605-8CC8-4543-9F5D-E8602D258CED"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha30:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "702EBB22-3E9F-4CBE-B855-2E3642C530B1"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha31:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7C17AD66-684F-4662-AF16-838FF05F47D5"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha32:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "13C25963-CAE7-49AA-A941-254DCE289E35"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha33:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B6BF0C2F-DD2B-4864-961F-CA808EF22633"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha34:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8FBB21E9-CB73-4CB1-841A-D1C08167DB51"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha35:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4CD55F0B-D854-43D4-A0F5-F83386DB24C9"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha36:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1097E8DF-3D0E-47C6-882D-E37B22119538"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha37:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8C60F121-1C0B-4EB5-87EF-F1BED070C13B"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha38:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "04D8514D-CC66-4E6B-90C8-6108F0DAA661"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha39:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4BB65A73-7BB7-42E4-97A3-4D6305172E05"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha4:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A052DFCA-EDCC-43D7-82C7-E5311F6F7687"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha40:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "192A78FB-E141-4F14-8C4A-20A4118B01C9"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha41:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CA4FEA42-4240-42B1-A5C2-6F74CBBACB92"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha42:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7192B894-2616-4852-850B-39CF6FCAC4F1"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha43:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3323535E-C323-4FD9-81E9-8F7A045EDD59"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha44:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "20A0CF2D-C8C0-4972-8F2B-02B67C171CA2"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha45:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EDC9ECE2-303E-429F-8E1B-EC6C6C575642"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha46:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A8914A97-5BCA-44ED-8767-1C4B5029CA2E"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha47:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D1BA3306-9F5B-4F9D-B472-D04E9018667E"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha48:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3CE968D2-0024-45CD-B458-06D13F598875"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha49:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7FF06066-8433-46B4-A935-66FC2EFA4F2E"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha5:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "12B11714-B961-4330-B241-FC5AF94FDBE8"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha50:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "47A519A3-6E15-4758-871A-CA5CB2ECBD75"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha51:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "85FEA7B3-1B31-45C7-89B4-2502DA305BAD"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha6:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "37A7C42B-4986-4BB6-BB27-0324A9AA1CFF"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha7:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C793834B-64B4-4DE9-BD7D-79B52C30C34E"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha8:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7AD455C8-88BE-4A0A-B33D-3A7811FFB753"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha9:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "26C475A2-997C-4C3A-8CB6-04AB3534BBC3"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}