CVE-2026-97691 get-convex CVE debrief

Who should care

Developers and administrators of self-hosted Convex deployments should assess their exposure and update their deployments to the patched versions. They should also monitor for suspicious activity and review and update local deployment binaries to ensure patching. This will help prevent unauthorized data access and ensure the security of their deployments.

Why it matters

CVE-2026-97691 is a medium-severity vulnerability in Convex that allows unauthorized data access in rare cases. Self-hosted deployments prior to August 10, 2026, are affected. Developers and administrators should assess their exposure, update deployments, and monitor for suspicious activity.

• Verify and update self-hosted Convex deployments to prevent unauthorized data access
• Monitor Convex deployments for suspicious activity
• Review and update local deployment binaries to ensure patching

Technical summary

A vulnerability in Convex, an open-source reactive database, allows a malicious user to perform unauthorized reading of deployment information in rare cases. The issue is fixed in the self-hosted image published on August 10, 2026, and local binary precompiled-2026-08-10-c0cb7ae. This vulnerability has a medium severity and is identified as CVE-2026-97691. Affected deployments should be updated to prevent unauthorized data access. The CVE record and source item provide details on the vulnerability in Convex, an open-source reactive database.

Defensive priority

Medium priority for self-hosted Convex deployments

Recommended defensive actions

• Review and update self-hosted Convex deployments to use the patched self-hosted image published on August 10, 2026, or later
• Verify local deployment binaries and update to precompiled-2026-08-10-c0cb7ae or later
• Monitor Convex deployments for any suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability in Convex, an open-source reactive database. A malicious user can, in rare cases, perform unauthorized reading of deployment information from a Convex deployment prior to the self-hosted image published on August 10, 2026, and local deployment binary precompiled-2026-08-10-c0cb7ae.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.