EUVD-2026-97834Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach self-hosted Convex endpoint
-
ExploitInduce required interaction
-
ExecutionTrigger access-control flaw
-
ImpactRead unauthorized deployment information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation is limited to self-hosted Convex backend deployments running an image/binary older than the 2026-08-10 release (image published 2026-08-10, binary precompiled-2026-08-10-c0cb7ae); Convex cloud deployments were patched automatically and are not exploitable. The vendor explicitly states the flaw is reachable only 'in rare cases,' and the CVSS vector's UI:R indicates required user/operator interaction, both of which materially limit real-world exploitability. The specific feature, configuration, or protocol path is intentionally undisclosed by the maintainer, so the exact triggering condition cannot be enumerated from available data. |
| Impact | This is a genuinely low-priority issue despite the 'network' attack vector. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, base 4.3) scores it MEDIUM, with impact limited to low confidentiality (I:N/A:N) - only unauthorized reading of deployment information, no write or availability impact. Crucially, the vector marks AC:L but the description explicitly states exploitation is possible only 'in rare cases,' which conflicts with low attack complexity and suggests the real-world complexity is higher than the published vector indicates. No EPSS score, KEV listing, or POC was provided; there is no public exploit identified at time of analysis, and the maintainer states no evidence of exploitation is known. The vendor has also deliberately withheld the affected component and technical mechanism, meaning the exploitation mechanism cannot be independently verified. Cloud deployments were auto-patched, so residual risk is confined to un-updated self-hosted/local Convex backends. Net: a low-impact, hard-to-trigger information-disclosure bug that is a routine patch-cycle item, not an emergency. |
| Exploit ScenarioDerived | A malicious user interacts with an un-updated self-hosted Convex backend (predating the 2026-08-10 image) and, under uncommon conditions, triggers a flaw that returns deployment information they should not be able to read. No public exploit code exists, and the maintainer has intentionally withheld the technical mechanism; the UI:R flag indicates some victim or operator interaction is part of the path, and the 'rare cases' wording implies non-trivial preconditions. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
Convex Backend self-hosted deployments running images or local binaries older than the August 10, 2026 release can, in rare cases, allow a remote unauthenticated attacker to read deployment information if user interaction is achieved; Convex cloud deployments were patched automatically and are not affected. The maintainer intentionally withheld the affected component and trigger mechanism, no public exploit identified at time of analysis, and the independent assessment rates this as a genuinely low-priority issue despite the network attack vector because exploitation requires interaction and high attack complexity. The vendor CVSS is 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N), while the independent assessment uses AC:H; only confidentiality is affected, not integrity or availability.
RemediationAI
Upgrade self-hosted Convex Backend to the image published on August 10, 2026 or newer, or to local binary precompiled-2026-08-10-c0cb7ae or later; these are the vendor-released fixes. Convex cloud customers need no action because cloud deployments were patched automatically. Because the vendor intentionally withheld the vulnerable component, no specific feature can be disabled as a workaround; compensating controls are to restrict network access to the self-hosted Convex backend deployment endpoints to trusted users/networks (for example, VPN or zero-trust access), which may break external app clients that rely on direct reachability, and to monitor deployment-information read access for anomalous activity. Audit self-hosted instances for versions older than the fixed image/binary and apply the fix from the advisory at https://github.com/get-convex/convex-backend/security/advisories/GHSA-52c3-c7j7-vjx6; no public exploit identified at time of analysis, but prompt upgrade is still advisable for exposed instances.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Convex is an open-source reactive database/backend platform; the affected component is the self-hosted Convex Backend, represented by CPE cpe:2.3:a:get-convex:convex-backend:*:*:*:*:*:*:*:* for versions prior to the 2026-08-10 image/binary. The issue is classified CWE-284 (Improper Access Control), indicating a missing or incorrect authorization check that permits read-only disclosure of deployment information, consistent with C:L and I:N/A:N. The vendor tagged the report with Authentication Bypass but intentionally withheld the exact feature, configuration, or protocol path, so the trigger cannot be enumerated; exploitation is reachable over the network (AV:N) but requires user interaction (UI:R) and is assessed as high complexity (AC:H) and rare, which limits real-world impact. Convex cloud was patched automatically, and the fix is the self-hosted image published August 10, 2026 and local binary precompiled-2026-08-10-c0cb7ae.
Know when Convex Backend gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-reachable and unauthenticated (AV:N/PR:N) but 'rare cases' plus required interaction justify AC:H and UI:R; impact is read-only deployment info, so C:L and I:N/A:N.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
DescriptionCVE.org
Convex is an open-source reactive database for application developers. Prior to the self-hosted image published on August 10, 2026 and local deployment binary precompiled-2026-08-10-c0cb7ae, a malicious user can, in rare cases, perform unauthorized reading of deployment information from a Convex deployment. The maintainer has intentionally withheld the affected component and technical mechanism to protect self-hosted deployments that have not been updated, and no evidence of exploitation is known. Convex cloud deployments were patched automatically. This issue is fixed in the self-hosted image published on August 10, 2026 and local binary precompiled-2026-08-10-c0cb7ae.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB