Convex Backend
Monthly
Convex Backend self-hosted deployments running images or local binaries older than the August 10, 2026 release can, in rare cases, allow a remote unauthenticated attacker to read deployment information if user interaction is achieved; Convex cloud deployments were patched automatically and are not affected. The maintainer intentionally withheld the affected component and trigger mechanism, no public exploit identified at time of analysis, and the independent assessment rates this as a genuinely low-priority issue despite the network attack vector because exploitation requires interaction and high attack complexity. The vendor CVSS is 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N), while the independent assessment uses AC:H; only confidentiality is affected, not integrity or availability.
Convex Backend self-hosted deployments running images or local binaries older than the August 10, 2026 release can, in rare cases, allow a remote unauthenticated attacker to read deployment information if user interaction is achieved; Convex cloud deployments were patched automatically and are not affected. The maintainer intentionally withheld the affected component and trigger mechanism, no public exploit identified at time of analysis, and the independent assessment rates this as a genuinely low-priority issue despite the network attack vector because exploitation requires interaction and high attack complexity. The vendor CVSS is 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N), while the independent assessment uses AC:H; only confidentiality is affected, not integrity or availability.