CVE-2026-63116

Executive Summary

CVE-2026-63116 is an improper authorization vulnerability in deepstream, an open-source server for real-time data sync, messaging, and RPC at scale. In versions 10.1.0 to 10.1.1, the permission rule map omits the PATCH_MULTI record action, causing the permission engine to return a null rule specification that is incorrectly interpreted as an unconditional allow. Any authenticated user can modify arbitrary protected records, corrupt application state, or disrupt service. The vulnerability is fixed in version 10.1.1.

Technical Analysis

deepstream operates a permission subsystem that maps record operations to rule specifications. The file src/services/permission/valve/rules-map.ts defines the RULES_MAP used by the Valve permission engine. Within this map, the RECORD_ACTION.PATCH_MULTI action is absent. When an authenticated client issues a PATCH_MULTI record operation and the deployment is configured with permission.type set to config, the function getRulesForMessage cannot locate a rule specification for that action. It returns a null rule specification. The function ConfigPermission.canPerformAction then treats the missing specification as an unconditional allow rather than applying the intended RULE_TYPES.WRITE restriction. This is a classic fail-open authorization flaw (CWE-862, Missing Authorization). The attack surface is the deepstream server’s message handling endpoint, which is network-accessible. The vulnerability requires authentication (PR:L) but no special privileges or user interaction. Notably, deployments using the default permission.type of none already permit all operations and are not additionally affected. The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H yields a base score of 8.8, reflecting high confidentiality, integrity, and availability impact.

Exploitation Scenarios

1. Reconnaissance/target identification: An attacker identifies a deepstream server version 10.1.0 (or 10.1.x prior to 10.1.1) that uses permission.type set to config. This can be done via version fingerprinting, error messages, or configuration disclosure. No public PoC exists; the attack chain is inferred from the vulnerability class.
2. Authentication: The attacker authenticates as any valid user. No elevated privileges are required.
3. Triggering the flaw: The attacker sends a PATCH_MULTI record operation. Because the RULES_MAP lacks an entry for RECORD_ACTION.PATCH_MULTI, getRulesForMessage returns a null rule specification, and ConfigPermission.canPerformAction incorrectly allows the action. The attacker can then modify arbitrary protected records.
4. Post-exploitation impact: The attacker can corrupt application state by altering records that should be write-protected, potentially leading to data integrity loss, service disruption, or further compromise of dependent backend services. The high availability impact (A:H) suggests that record corruption or mass modification could render the service unusable.

No public exploit code or Nuclei template is available as of this report. The EPSS score has not yet been assigned by FIRST.org.

Impact Assessment

The vulnerability allows any authenticated user to bypass authorization controls and modify protected records. This directly affects the integrity of application data (I:H) and can cause service disruption (A:H). Confidentiality is also impacted (C:H) because records that should be read-protected may be modified or their contents inferred through manipulation. The blast radius includes all deployments of deepstream 10.1.0 to 10.1.1 that use permission.type=config, which is a common production configuration. The default permission.type=none deployments are not additionally affected, as they already permit all operations. The CVSS score of 8.8 (High) reflects the serious nature of the authorization bypass, though it requires authentication. No threat actor campaigns or exploit-in-the-wild evidence have been observed.

Detection Guidance

Detection should focus on anomalous PATCH_MULTI record operations, especially from users or sessions that normally do not perform such actions, and on deepstream server logs indicating permission rule misses or null specifications.

Sigma Rule

title: deepstream PATCH_MULTI Authorization Bypass Attempt
id: 8f4b2c1a-9d3e-4f5a-8b7c-1e2d3f4a5b6c
status: experimental
description: Detects exploitation attempts of CVE-2026-63116 by monitoring for PATCH_MULTI record operations in deepstream logs.
author: Threat Intelligence
date: 2026-05-14
logsource:
    product: deepstream
    service: permission
detection:
    selection:
        action: 'PATCH_MULTI'
        permission_type: 'config'
    condition: selection
falsepositives:
    - Legitimate administrative use of PATCH_MULTI
level: high
tags:
    - attack.t1190
    - cve.2026.63116

YARA Rule

rule CVE_2026_63116_deepstream_PATCH_MULTI
{
    meta:
        description = "Detects potential exploitation of CVE-2026-63116 in deepstream source code or logs"
        author = "Threat Intelligence"
        date = "2026-05-14"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-63116"
        cve = "CVE-2026-63116"

    strings:
        $a = "PATCH_MULTI" ascii wide
        $b = "RULES_MAP" ascii wide
        $c = "getRulesForMessage" ascii wide
        $d = "canPerformAction" ascii wide
        $e = "ConfigPermission" ascii wide

    condition:
        any of them
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-63116 deepstream PATCH_MULTI Authorization Bypass Attempt"; flow:to_server,established; content:"PATCH_MULTI"; nocase; classtype:attempted-admin; reference:cve,2026-63116; sid:10000001; rev:1;)

Elastic Detection

process where event.action == "PATCH_MULTI" and process.name == "deepstream" and not user.name in ("admin", "service_account")

Splunk SPL Query

index=deepstream_logs (action="PATCH_MULTI" OR "PATCH_MULTI") permission_type="config"
| stats count by user, src_ip, action, permission_type
| where count > 0

Wazuh OSSEC Rule

<group name="deepstream,">
  <rule id="100001" level="12">
    <decoded_as>json</decoded_as>
    <field name="action">PATCH_MULTI</field>
    <field name="permission_type">config</field>
    <description>CVE-2026-63116: deepstream PATCH_MULTI authorization bypass attempt detected.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations: If upgrade is not immediately possible, restrict network access to the deepstream server to trusted clients only. Review and tighten authentication mechanisms. Monitor for anomalous PATCH_MULTI operations. Consider temporarily changing permission.type to a more restrictive setting if feasible, though this may impact functionality. Note that permission.type=none is not additionally affected, but switching to config without the fix does not help.

2. Patch/upgrade steps: Upgrade to deepstream version 10.1.1 or later. The fix adds RECORD_ACTION.PATCH_MULTI to RULES_MAP so that the permission engine correctly applies RULE_TYPES.WRITE. Verify the upgrade by checking the version and testing that a PATCH_MULTI operation by a non-privileged user is denied when permission.type=config.

3. Long-term hardening: Implement defense-in-depth authorization checks outside the permission engine. Enforce the principle of least privilege for authenticated users. Regularly audit permission maps and rule specifications for omissions. Use automated testing to ensure all record actions are covered by permission rules. Enable comprehensive logging and alerting for permission bypass indicators.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-63116
• deepstream GitHub repository (source): https://github.com/deepstreamIO/deepstream.io
• CWE-862: Missing Authorization — https://cwe.mitre.org/data/definitions/862.html
• CVSS 3.1 Specification: https://www.first.org/cvss/v3.1/specification-document
• deepstream documentation on permissions: https://deepstream.io/docs/