CVE-2026-97691: Convex: Unauthorized data access
Convex is an open-source reactive database for application developers. Prior to the self-hosted image published on August 10, 2026 and local deployment binary precompiled-2026-08-10-c0cb7ae, a malicious user can, in rare cases, perform unauthorized reading of deployment information from a Convex deployment. The maintainer has intentionally withheld the affected component and technical mechanism to protect self-hosted deployments that have not been updated, and no evidence of exploitation is known. Convex cloud deployments were patched automatically. This issue is fixed in the self-hosted image published on August 10, 2026 and local binary precompiled-2026-08-10-c0cb7ae.
Affected Software
Event History
Frequently Asked Questions
Which deployments need action?
Self-hosted Convex deployments using images published before August 10, 2026 or local deployment binaries older than precompiled-2026-08-10-c0cb7ae need to be updated. Convex cloud deployments were patched automatically.
What information could be exposed?
In rare cases, an attacker could read deployment information from a Convex deployment. The affected component and technical mechanism were intentionally withheld, and no evidence of exploitation is known.
Does exploitation require authentication or user interaction?
The reported CVSS vector indicates network reachability, low attack complexity, no required privileges, and required user interaction. The advisory does not provide further details about the interaction needed.
What should self-hosted operators do if they cannot immediately update?
The provided information identifies updating to the August 10, 2026 self-hosted image or precompiled-2026-08-10-c0cb7ae local binary as the fix. It does not provide a documented workaround or mitigation for deployments that cannot yet be updated.