CVE-2026-52394 Details
Description
DeepSeek V4 is vulnerable to Incorrect Access Control via a crafted input.
A vulnerability in DeepSeek V4's chat interface allows for incorrect access control, resulting in unauthorized information disclosure. This issue arises from the application's failure to properly isolate multi-tenant reasoning session data. By sending a crafted input, an attacker can bypass session context boundaries and access reasoning chain content generated in other users' sessions. The vulnerability affects DeepSeek V4, specifically through the chat interface at chat.deepseek.com.
The vendor has fixed this vulnerability. Users are advised to update to the latest version of DeepSeek.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 13, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gist.github.com/CAPTAIN1275/48a0b7d67d0e58cb05c607e0d715447c | CISA-ADP | ExploitRemedyTechnical Description |
| http://deepseek.com | [email protected] | Vendor |
| https://gist.github.com/CAPTAIN1275/48a0b7d67d0e58cb05c607e0d715447c | [email protected] | ExploitRemedyTechnical Description |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-201 | Insertion of Sensitive Information Into Sent Data | CISA-ADP |
| CWE-209 | Generation of Error Message Containing Sensitive Information | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| DeepSeek | V4 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 13, 2026 | New CVE Received | [email protected] |