XRAY: How to Migrate CVSS v4 Data After Upgrading Xray to 3.131+

Applies To

Instances upgraded to Xray 3.131 or later from an older version

Does Not Apply

Fresh installations of Xray 3.131+ — the vulnerability database is initialized with CVSS v4 data; no migration needed

Background

Xray 3.131 introduced CVSS v4.0 scoring support. For instances upgraded from an older version, existing vulnerability records in the database do not yet contain CVSS v4 scores. A DB Sync migration must be triggered manually to back-fill the data before v4 scores (e.g. "8.4 v4") appear in the UI.

Step 1 — Verify Whether CVSS v4 Data Is Missing

SELECT * FROM public.public_vulnerabilities_cves pvc
  WHERE cve = 'CVE-2026-7598';

• Row exists and CVSS v4 fields are populated → no migration needed.

• No row, or CVSS v4 fields are null → proceed to Step 2.

Step 2 — Run the DB Sync Migration (~2–4 hours)

Note:

All Xray scanning tasks are suspended during the migration. Schedule a maintenance window before proceeding.

2.1  Update system.yaml — Disable Impact Analysis

• Note the indentation, which needs to be consistent with that in <JFrog_Home>/xray/var/etc/system.yaml

server:
  dbSync:
    version3:
      enabled: true
    impactAnalysis:
      enabled: false

• Save the file and restart the Xray service.

2.2  Remove the Database Statement Timeout

ALTER DATABASE <xrayDatabaseName>  SET statement_timeout = 0;
ALTER ROLE     <xrayUserName> SET statement_timeout = 0;

2.3  Trigger the Migration via REST API

curl -u admin:'<passwd>'  --request POST
'http://localhost:8082/xray/api/v1/migration/trigger/dbsync_cvss_v4?mode=online' \
--header 'Content-Type: application/json'

2.4  Wait for the Migration to Complete

Monitor the Xray logs. Migration is complete when the "DB sync finished" message appears.

2.5  Re-enable Impact Analysis and Restart

server:
  dbSync:
    version3:
      enabled: true
    impactAnalysis:
      enabled: true

Step 3 — Verify

Re-run the query from Step 1 and confirm the CVSS v4 fields are now populated. Check the Xray UI to verify the v4 score (e.g. "8.4 v4") is displayed correctly or check with the Export Component Details V2 API.