A malicious user may, in rare cases, read deployment configuration data from a Convex deployment. This unauthorized data access could expose sensitive internal details such as environment variables, service endpoints, or other configuration information, enabling further targeted attacks. The weakness is a classic authorization bypass, classified as CWE‑284. The description indicates that the vulnerability exists only in self‑hosted builds published before August 10, 2026 and was patched in a later image and local binary. No exploitation has been observed yet.

The affected product is Convex, an open‑source reactive database used via self‑hosted deployments. Vulnerable releases include the self‑hosted image published on August 10, 2026 and the precompiled local binary tagged precompiled‑2026‑08‑10‑c0cb7ae. Containers or binaries installed before this date without the update remain susceptible. Convex cloud deployments were patched automatically and are not affected.

The CVSS base score of 4.3 indicates a moderate impact, but the EPSS score is not available and the vulnerability is not listed in CISA's KEV catalog. The lack of known exploitation and the specification that the flaw manifests only in rare cases suggest a lower likelihood of successful attacks. Nonetheless, because the flaw permits reading of deployment information, any compromised or malicious user with access to the deployment environment may exploit it. The risk is therefore moderate, with the primary threat being unauthorized disclosure of internal configuration details.