CVE-2026-97691
4.3MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-284
Impact
Remote attackers can read deployment metadata without authorization if they can trick a user into interacting with a malicious link or site. It only exposes deployment information and cannot modify data or execute code.
Root cause
Improper access control in the deployment interface allows unauthorized exposure of deployment information.
Affected systems
Convex self-hosted images published before August 10, 2026, and local deployment binaries prior to precompiled-2026-08-10-c0cb7ae.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Fix & remediation
Upgrade self-hosted instances to the container image published on August 10, 2026 (tag c0cb7ae17f54e14846c243c5332a8a5e6d0e19d4 or later) or local binary precompiled-2026-08-10-c0cb7ae. No interim mitigations are provided.
$ docker pull ghcr.io/get-convex/convex-backend:c0cb7ae17f54e14846c243c5332a8a5e6d0e19d4AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Convex is an open-source reactive database for application developers. Prior to the self-hosted image published on August 10, 2026 and local deployment binary precompiled-2026-08-10-c0cb7ae, a malicious user can, in rare cases, perform unauthorized reading of deployment information from a Convex deployment. The maintainer has intentionally withheld the affected component and technical mechanism to protect self-hosted deployments that have not been updated, and no evidence of exploitation is known. Convex cloud deployments were patched automatically. This issue is fixed in the self-hosted image published on August 10, 2026 and local binary precompiled-2026-08-10-c0cb7ae.