Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-97691 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

Convex is an open-source reactive database for application developers. Prior to the self-hosted image published on August 10, 2026 and local deployment binary precompiled-2026-08-10-c0cb7ae, a malicious user can, in rare cases, perform unauthorized reading of deployment information from a Convex deployment. The maintainer has intentionally withheld the affected component and technical mechanism to protect self-hosted deployments that have not been updated, and no evidence of exploitation is known. Convex cloud deployments were patched automatically. This issue is fixed in the self-hosted image published on August 10, 2026 and local binary precompiled-2026-08-10-c0cb7ae.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:4.3 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

CNA: [email protected]CVSS-B:4.3 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/get-convex/convex-backend/pkgs/container/convex-backend/1118244498?tag=c0cb7ae17f54e14846c243c5332a8a5e6d0e19d4	[email protected]	Broken LinkVendor
https://github.com/get-convex/convex-backend/security/advisories/GHSA-52c3-c7j7-vjx6	[email protected]	AdvisoryRemedyVendor

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-284	Improper Access Control	[email protected]

Affected Products

Product	Versions
Convex	< c0cb7ae17f54e14846c243c5332a8a5e6d0e19d4 < precompiled-2026-08-10-c0cb7ae
CPE No CPEs found in CPE dictionary for this product. Remediation Upgrade: c0cb7ae17f54e14846c243c5332a8a5e6d0e19d4moderate effort To update your self-hosted deployment, run: ```shell # In the directory containing your docker-compose.yml file… docker compose pull docker compose up ``` Upgrade: precompiled-2026-08-10-c0cb7aemoderate effort To update your local deployment, run `npx convex dev` and confirm the upgrade when prompted.

Product

Versions

Convex

< c0cb7ae17f54e14846c243c5332a8a5e6d0e19d4

< precompiled-2026-08-10-c0cb7ae

CPE

No CPEs found in CPE dictionary for this product.

Remediation

Upgrade: c0cb7ae17f54e14846c243c5332a8a5e6d0e19d4moderate effort
To update your self-hosted deployment, run: ```shell # In the directory containing your docker-compose.yml file… docker compose pull docker compose up ```
Upgrade: precompiled-2026-08-10-c0cb7aemoderate effort
To update your local deployment, run `npx convex dev` and confirm the upgrade when prompted.

Change History

2 change records found show changes

Date	Action	Recorded By
Oct 15, 2026	CVE Modified	CISA-ADP
Oct 12, 2026	New CVE Received	[email protected]