CVE-2026-49252: deepstream Server Prototype Pollution Enabling Privilege Escalation
deepstream server versions prior to 10.0.5 contain a prototype pollution flaw (CWE-1321) that an authenticated user with write permission to any record could abuse for potential privilege escalation. The GitHub CNA rates it 9.9 (critical) under CVSS 3.1, and the issue is fixed in version 10.0.5.
Overview
CVE-2026-49252 is a prototype pollution vulnerability (CWE-1321) in deepstream, a server that lets clients and backend services sync data, send messages and make RPCs at scale. According to the GitHub security advisory, versions prior to 10.0.5 are affected. A related code change is available in the project's commit history.
Impact
The CNA (security-advisories@github.com) assigned a CVSS 3.1 base score of 9.9 (critical) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L. This means the flaw is reachable over the network with low complexity, requires only low privileges, needs no user interaction, and has a changed scope with high confidentiality and integrity impact and low availability impact.
The description states that exploitation can lead to potential privilege escalation by any authenticated user who has write permission to any record. In practice, prototype pollution in a Node.js-style server can alter properties shared across objects, which may influence permission checks or application logic; the exact mechanism is not detailed in the record.
Affected products and versions
- deepstream (deepstreamIO/deepstream.io): versions prior to 10.0.5
- Fixed in: 10.0.5
The record does not include structured CPE or package-level affected data beyond the description.
Exploitation status
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, and no confirmed exploitation appears in the sources consulted. No EPSS score is available in the record.
Remediation and mitigation
- Upgrade deepstream to version 10.0.5 or later.
- Until upgrading, review and tighten record write permissions so that only trusted users can write records, reducing the pool of users able to trigger the issue.
- Audit accounts with write access and remove unnecessary privileges.
- Review the advisory for any additional vendor guidance.
Detection guidance
- Inventory deployments and dependency manifests to identify deepstream instances older than 10.0.5.
- Monitor record write operations for unusual property names commonly associated with prototype pollution (for example keys referencing object prototypes or constructors) and alert on them.
- Watch for unexpected permission changes or users performing actions beyond their assigned roles.
Limitations of the available information
The NVD status is "Deferred", and the record contains no EPSS score, SSVC assessment or structured affected-version data. Technical details of the vulnerable code path are not described in the record beyond the referenced commit. The full scope of privilege escalation achievable in different configurations is unknown.
Frequently asked questions
Which deepstream versions are affected by CVE-2026-49252?
Versions prior to 10.0.5 are affected; the issue is fixed in 10.0.5.
Who can exploit this vulnerability?
Per the description, any authenticated user with write permission to any record could potentially escalate privileges.
Is CVE-2026-49252 being exploited in the wild?
It is not in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.
How severe is it?
The GitHub CNA rates it CVSS 3.1 9.9, critical.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.