CVE-2026-31828
Parseplatform Parse-Server ≤ 8.6.26
Raw vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-31828 is a medium-severity LDAP Injection (CWE-90) vulnerability in Parseplatform Parse-Server. Its CVSS base score is 6.0 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 35th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-31828 is an LDAP injection vulnerability in the LDAP authentication adapter of Parse Server, an open source backend deployable on any Node.js-compatible infrastructure. In versions prior to 9.5.2-alpha.13 and 8.6.26, user-supplied input from authData.id is directly interpolated into LDAP Distinguished Names (DN) and group search filters without proper escaping of special characters. This flaw, classified under CWE-90 with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), affects Parse Server deployments that utilize the LDAP authentication adapter alongside group-based access control.
An attacker with valid LDAP credentials and low privileges (PR:L) can exploit this vulnerability remotely over the network (AV:N) with low complexity and no user interaction required. By injecting malicious payloads into the authData.id field, the attacker can manipulate the LDAP bind DN structure and evade group membership validation filters. This enables privilege escalation, allowing any authenticated LDAP user to impersonate membership in any restricted group and gain elevated access within the affected Parse Server instance.
The Parse community has addressed this issue in releases 8.6.26 and 9.5.2-alpha.13, as detailed in the corresponding GitHub release notes and security advisory GHSA-7m6r-fhh7-r47c. Security practitioners should upgrade to these fixed versions and review configurations for LDAP authentication adapters using group-based controls to mitigate the risk of exploitation.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-10928
Vulnerability Data
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.13 and 8.6.26, the LDAP authentication adapter is vulnerable to LDAP injection. User-supplied input (authData.id) is interpolated directly into LDAP…
more
Distinguished Names (DN) and group search filters without escaping special characters. This allows an attacker with valid LDAP credentials to manipulate the bind DN structure and to bypass group membership checks. This enables privilege escalation from any authenticated LDAP user to a member of any restricted group. The vulnerability affects Parse Server deployments that use the LDAP authentication adapter with group-based access control. This vulnerability is fixed in 9.5.2-alpha.13 and 8.6.26.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.2.6
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover LDAP injection flaws through static analysis or crafted test cases.
Input validation directly stops untrusted data from reaching an LDAP query builder without neutralization of special characters.
Secure engineering principles require safe query construction and escaping that structurally prevents LDAP injection.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input neutralization and query parameterization to prevent LDAP injection.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development catches LDAP injection via dynamic analysis or fuzzing, but does not prevent it at the source.
Secure development lifecycle mandates input validation and query construction practices that directly prevent LDAP injection.
Application security requirements include explicit rules for safe construction of directory queries, mitigating LDAP injection.
Secure coding standards require proper neutralization of LDAP special characters, directly eliminating this weakness.
Secure architecture principles encourage safe query interfaces but do not prescribe the specific coding controls needed for LDAP injection.
Information access restriction limits who can query LDAP but does not address how queries are built.