VulnSocial

CVE-2026-49252Disclosure

LOWCVSS 9.9 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. Versions prior to 10.0.5 are vulnerable to Prototype Pollution. Exploitation can lead to potential privilege escalation from any authenticated user with write permission to any record. This issue has been fixed in version 10.0.5.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-1321

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 5 mentions across 5 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 5 signals
  • Disclosure: 5 classified signals
  • Peaked 4d ago at 1 mentions (2026-06-18); latest day: 1
  • 5 total mentions across 5 days

Deep dive

Activity timeline5 mentions / 5d
00111Mentions · 2026-06-18: 1Mentions · 2026-06-19: 1Mentions · 2026-06-26: 1Mentions · 2026-08-10: 1Mentions · 2026-10-07: 1Patch / Workaround · 2026-06-19: 1Technical Details · 2026-06-18: 1Technical Details · 2026-06-19: 1Technical Details · 2026-06-26: 1Technical Details · 2026-08-10: 1Technical Details · 2026-10-07: 106-1806-1906-2608-1010-07
Signal classification1 categories
Disclosure
5100.0%
Referenced assets4 URLs
Full discourse5 posts
  • Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters
    Disclosure

    #CVE-2026-49252 - Critical Privilege Escalation in Deepstream. Prototype Pollution bug allows auth'd users with write access to escalate privileges. #CVSS 9.9. No patch available yet. #Update to 10.0.5 immediately. #Deepstream #infosec #cybersecurity #CVEAlert more info: https://www.valtersit.com/cve/CVE-2026-49252

    Post summary

    CVE‑2026‑49252 is a newly disclosed critical privilege‑escalation flaw in Deepstream caused by prototype pollution, rated CVSS 9.9, with no patch yet but the latest 10.0.5 update is recommended.

    0001048
    948 followersView on X
  • DailyCVE@dailycve
    Disclosure

    🔴 guardvibe, Prototype Pollution, #CVE-2026-49252 (Critical) -DC-Oct2026-2791 https://dailycve.com/guardvibe-prototype-pollution-cve-2026-49252-critical-dc-oct2026-2791/

    Post summary

    The tweet discloses a new prototype pollution vulnerability (CVE‑2026‑49252) classified as critical.

    0000026
    241 followersView on X
  • Joey Romaine 🇺🇸 |=★=|@Tank23x0
    Disclosure

    Every week brings new attack surface. CVE-2026-49252 — take a look. deepstream is vulnerable to prototype pollution Build like the next disruption is already in motion — because it is.

    Post summary

    The message alerts that deepstream is vulnerable to CVE-2026-49252 via prototype pollution, providing only the basic vulnerability type without additional details or remedies.

    0000052
    357 followersView on X
  • DailyCVE@dailycve
    Disclosure

    🔴 deepstreamio, Prototype Pollution (CWE-1321), #CVE-2026-49252 (Critical) -DC-Jun2026-706 https://dailycve.com/deepstreamio-prototype-pollution-cwe-1321-cve-2026-49252-critical-dc-jun2026-706/

    Post summary

    Deepstreamio is affected by a critical prototype pollution vulnerability (CVE‑2026‑49252, CWE‑1321). No PoC, exploit, patch, or active exploitation details are provided in the text.

    0000054
    216 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-49252 Prototype Pollution in Deepstream Prior to 10.0.5 Enables Privilege Escalation https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-49252

    Post summary

    The post announces a prototype‑pollution vulnerability in Deepstream (v<10.0.5) that allows privilege escalation, with no evidence of an existing PoC, exploit tool, or active exploitation.

    0000042
    4.1K followersView on X

Explore more

Back to dashboard