CVE-2026-97691

Received Received - Intake

Information Disclosure in Convex Database

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: GitHub, Inc.

Description

Convex is an open-source reactive database for application developers. Prior to the self-hosted image published on August 10, 2026 and local deployment binary precompiled-2026-08-10-c0cb7ae, a malicious user can, in rare cases, perform unauthorized reading of deployment information from a Convex deployment. The maintainer has intentionally withheld the affected component and technical mechanism to protect self-hosted deployments that have not been updated, and no evidence of exploitation is known. Convex cloud deployments were patched automatically. This issue is fixed in the self-hosted image published on August 10, 2026 and local binary precompiled-2026-08-10-c0cb7ae.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-97691

EUVD

EUVD-2026-97834

Affected Vendors & Products

Vendor	Product	Version / Range
get-convex	convex-backend	< precompiled-2026-08-10-c0cb7ae

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability in Convex, an open-source reactive database, allows a malicious user to occasionally read deployment information without authorization. The maintainer has not disclosed the exact affected component or mechanism to protect unpatched self-hosted deployments. No exploitation evidence exists, and cloud deployments were automatically patched.

Detection Guidance

Detection requires verifying if your Convex deployment is running the patched version (self-hosted image published on August 10, 2026 or local binary precompiled-2026-08-10-c0cb7ae). Check the deployment version or binary metadata for the update.

Impact Analysis

If you use a self-hosted Convex deployment that hasn't been updated, an attacker might access sensitive deployment details. This could include configuration or metadata, but not user data or full system control. Cloud deployments are not affected.

Compliance Impact

The vulnerability involves unauthorized reading of deployment information, which could potentially expose sensitive data depending on the deployment context. This may impact compliance with standards like GDPR or HIPAA if such data includes personally identifiable information or protected health information. However, the maintainer has not disclosed specific technical details to prevent exploitation, and no evidence of actual compromise is known.

Mitigation Strategies

Update to the patched self-hosted image (August 10, 2026) or local binary (precompiled-2026-08-10-c0cb7ae). Convex cloud deployments are already patched. No further action is required for cloud users.

Hi! I’m here to help you understand CVE-2026-97691. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70