CVE-2026-97691

Convex is an open-source reactive database for application developers. Prior to the self-hosted image published on August 10, 2026 and local deployment binary precompiled-2026-08-10-c0cb7ae, a malicious user can, in rare cases, perform unauthorized reading of deployment information from a Convex deployment. The maintainer has intentionally withheld the affected component and technical mechanism to protect self-hosted deployments that have not been updated, and no evidence of exploitation is known. Convex cloud deployments were patched automatically. This issue is fixed in the self-hosted image published on August 10, 2026 and local binary precompiled-2026-08-10-c0cb7ae.

• CWE-284

• https://github.com/get-convex/convex-backend/pkgs/container/convex-backend/1118244498?tag=c0cb7ae17f54e14846c243c5332a8a5e6d0e19d4
• https://github.com/get-convex/convex-backend/security/advisories/GHSA-52c3-c7j7-vjx6

Published

Oct 12, 2026

Last Modified

Oct 12, 2026

Status

Received

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-97685An authenticated LimeSurvey Community Edition 7.3.0 user all…7.1
• CVE-2026-97686Wind River VxWorks 7 prior to 26.09, specific system call ar…5.5
• CVE-2026-97687urllib3 is an HTTP client library for Python. From 1.26.0 un…7.6
• CVE-2026-97688urllib3 is an HTTP client library for Python. From 2.6.2 unt…6.9
• CVE-2026-97689urllib3 is an HTTP client library for Python. From 1.10.3 un…8.9
• CVE-2026-9769justhtml through 1.9.1 (fixed in 1.10.0) is vulnerable to un…7.5
• CVE-2026-9770Kasa EC71 v4 and EC70 v4 firmware contains a static cryptogr…5.3
• CVE-2026-9771The flash_copy() system call is verified by z_vrfy_flash_cop…8.8
• CVE-2026-97711Serialize JavaScript serializes JavaScript values to a super…2.3
• CVE-2026-97714CVE-2026-97714 is a is a vulnerability in the authentication…8.2
• CVE-2026-97715CVE-2026-97715 is a vulnerability in the client registration…7.1
• CVE-2026-97716CVE-2026-97716 is a vulnerability in the connection set up s…8.7