Couchbase Open source nosql database

By the Year

In 2025 there have been 4 vulnerabilities in Couchbase. Last year, in 2024 Couchbase had 15 security vulnerabilities published. Right now, Couchbase is on track to have less security vulnerabilities in 2025 than it did last year.

Recent Couchbase Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2025-52490	Jul 29, 2025	Couchbase Sync Gateway <3.2.6: Cleartext Passwords in Logs An issue was discovered in Couchbase Sync Gateway before 3.2.6. In sgcollect_info_options.log and sync_gateway.log, there are cleartext passwords in redacted and unredacted output.	Sync Gateway
CVE-2025-49015	Jun 18, 2025	Hostname Verification Bypass in Couchbase .NET SDK <3.7.1 The Couchbase .NET SDK (client library) before 3.7.1 does not properly enable hostname verification for TLS certificates. In fact, the SDK was also using IP addresses instead of hostnames due to a configuration option that was incorrectly enabled by default.	Net Sdk
CVE-2025-46619	Apr 30, 2025	Couchbase Server <7.6.4 - Unauthorized Sensitive File Access A security issue has been discovered in Couchbase Server before 7.6.4 and fixed in v.7.6.4 and v.7.2.7 for Windows that could allow unauthorized access to sensitive files. Depending on the level of privileges, this vulnerability may grant access to files such as /etc/passwd or /etc/shadow.	Couchbase Server
CVE-2024-56178	Jan 27, 2025	Couchbase Server 7.6.x-7.6.3 Privilege Escalation via security_admin_local An issue was discovered in Couchbase Server 7.6.x through 7.6.3. A user with the security_admin_local role can create a new user in a group that has the admin role.	Couchbase Server
CVE-2024-25673	Sep 19, 2024	Couchbase Server <7.6.2/7.2.6 HTTP Host Header Injection Couchbase Server 7.6.x before 7.6.2, 7.2.x before 7.2.6, and all earlier versions allows HTTP Host header injection.	Couchbase Server
CVE-2024-37034	Jul 26, 2024	Couchbase Server <7.2.5, <7.6.0: KV half-secure fails SCRAMSHA An issue was discovered in Couchbase Server before 7.2.5 and 7.6.0 before 7.6.1. It does not ensure that credentials are negotiated with the Key-Value (KV) service using SCRAM-SHA when remote link encryption is configured for Half-Secure.	Couchbase Server
CVE-2023-43768	Mar 27, 2024	Couchbase Server 6.6-7.2.0 Unauth Memcached OOM via Large Commands An issue was discovered in Couchbase Server 6.6.x through 7.2.0, before 7.1.5 and 7.2.1. Unauthenticated users may cause memcached to run out of memory via large commands.	Couchbase Server
CVE-2024-23302	Feb 29, 2024	Couchbase Server<7.2.4 Private Key Leak in goxdcr.log Couchbase Server before 7.2.4 has a private key leak in goxdcr.log.	Couchbase Server
CVE-2023-50436	Feb 29, 2024	Couchbase Server <7.2.4: ns_server Admin Credentials Leak in diag.log An issue was discovered in Couchbase Server before 7.2.4. ns_server admin credentials are leaked in encoded form in the diag.log file. The earliest affected version is 7.1.5.	Couchbase Server
CVE-2023-50437	Feb 29, 2024	Couchbase Server <=7.2.3 Ck Leak at pools/default/serverGroups&engageCluster2 An issue was discovered in Couchbase Server before 7.2.x before 7.2.4. otpCookie is shown with full admin on pools/default/serverGroups and engageCluster2.	Couchbase Server
CVE-2023-49931	Feb 29, 2024	Couchbase Server <7.2.4 SQL++ cURL /diag/eval Unrestricted An issue was discovered in Couchbase Server before 7.2.4. SQL++ cURL calls to /diag/eval are not sufficiently restricted.	Couchbase Server
CVE-2023-45874	Feb 29, 2024	Couchbase Server <=7.2.2: Reader Thread DoS Vulnerability An issue was discovered in Couchbase Server through 7.2.2. A data reader may cause a denial of service (outage of reader threads).	Couchbase Server
CVE-2023-49930	Feb 29, 2024	Couchbase Server <7.2.4 Unrestricted /diag/eval cURL Calls An issue was discovered in Couchbase Server before 7.2.4. cURL calls to /diag/eval are not sufficiently restricted.	Couchbase Server
CVE-2023-49932	Feb 29, 2024	Couchbase Server <7.2.4 N1QL cURL Host Restriction Bypass An issue was discovered in Couchbase Server before 7.2.4. An attacker can bypass SQL++ N1QL cURL host restrictions.	Couchbase Server
CVE-2023-43769	Feb 29, 2024	Couchbase Server 7.1.x < 7.1.5 & 7.2.x < 7.2.1 Unauth RMI Ports Exposed An issue was discovered in Couchbase Server through 7.1.4 before 7.1.5 and before 7.2.1. There are Unauthenticated RMI Service Ports Exposed in Analytics.	Couchbase Server
CVE-2023-49338	Feb 28, 2024	Couchbase Server 7.1/7.2 <7.2.4 No-Auth /admin/stats & vitals on 8093 Couchbase Server 7.1.x and 7.2.x before 7.2.4 does not require authentication for the /admin/stats and /admin/vitals endpoints on TCP port 8093 of localhost.	Couchbase Server
CVE-2023-45873	Feb 28, 2024	Couchbase Server <7.2.2: Data Reader Causes OOM-Triggered DoS An issue was discovered in Couchbase Server through 7.2.2. A data reader may cause a denial of service (application exist) because of the OOM killer.	Couchbase Server
CVE-2023-50782	Feb 05, 2024	python-cryptography: Remote Decryption of TLS RSA Exchanges A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.	Couchbase Server
CVE-2024-0519	Jan 16, 2024	OVB Memory Access in V8 Chrome<120 Heap Corrupt via Crafted HTML Out of bounds memory access in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)	Couchbase Server
CVE-2023-36667	Nov 08, 2023	Couchbase Server Directory Traversal before 7.1.5/7.2.1 Couchbase Server 7.1.4 before 7.1.5 and 7.2.0 before 7.2.1 allows Directory Traversal.	Couchbase Server
CVE-2023-45875	Nov 08, 2023	Couchbase Server 7.2.0: Private Key Log Leak when Adding Pre-7.0 Node An issue was discovered in Couchbase Server 7.2.0. There is a private key leak in debug.log while adding a pre-7.0 node to a 7.2 cluster.	Couchbase Server
CVE-2023-3079	Jun 05, 2023	Type confusion in V8 in Google Chrome prior to 114.0.5735.110 Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)	Couchbase Server
CVE-2023-2033	Apr 14, 2023	Type confusion in V8 in Google Chrome prior to 112.0.5615.121 Type confusion in V8 in Google Chrome prior to 112.0.5615.121 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)	Couchbase Server
CVE-2023-28470	Mar 23, 2023	In Couchbase Server 5 through 7 before 7.1.4 In Couchbase Server 5 through 7 before 7.1.4, the nsstats endpoint is accessible without authentication.	Couchbase Server
CVE-2022-42950	Feb 06, 2023	An issue was discovered in Couchbase Server 7.x before 7.0.5 and 7.1.x before 7.1.2 An issue was discovered in Couchbase Server 7.x before 7.0.5 and 7.1.x before 7.1.2. A crafted HTTP REST request from an administrator account to the Couchbase Server Backup Service can exhaust memory resources, causing the process to be killed, which can be used for denial of service.	Couchbase Server
CVE-2022-42951	Feb 06, 2023	An issue was discovered in Couchbase Server 6.5.x and 6.6.x before 6.6.6, 7.x before 7.0.5, and 7.1.x before 7.1.2 An issue was discovered in Couchbase Server 6.5.x and 6.6.x before 6.6.6, 7.x before 7.0.5, and 7.1.x before 7.1.2. During the start-up of a Couchbase Server node, there is a small window of time (before the cluster management authentication has started) where an attacker can connect to the cluster manager using default credentials.	Couchbase Server
CVE-2023-25016	Feb 06, 2023	Couchbase Server before 6.6.6 Couchbase Server before 6.6.6, 7.x before 7.0.5, and 7.1.x before 7.1.2 exposes Sensitive Information to an Unauthorized Actor.	Couchbase Server
CVE-2022-32556	Jul 21, 2022	An issue was discovered in Couchbase Server before 7.0.4 An issue was discovered in Couchbase Server before 7.0.4. A private key is leaked to the log files with certain crashes.	Couchbase Server
CVE-2022-34826	Jul 15, 2022	In Couchbase Server 7.1.x before 7.1.1 In Couchbase Server 7.1.x before 7.1.1, an encrypted Private Key passphrase may be leaked in the logs.	Couchbase Server
CVE-2022-33173	Jul 12, 2022	An algorithm-downgrade issue was discovered in Couchbase Server before 7.0.4 An algorithm-downgrade issue was discovered in Couchbase Server before 7.0.4. Analytics Remote Links may temporarily downgrade to non-TLS connection to determine the TLS port number, using SCRAM-SHA instead.	Couchbase Server
CVE-2022-33911	Jul 12, 2022	An issue was discovered in Couchbase Server 7.x before 7.0.4 An issue was discovered in Couchbase Server 7.x before 7.0.4. Field names are not redacted in logged validation messages for Analytics Service. An Unauthorized Actor may be able to obtain Sensitive Information.	Couchbase Server
CVE-2022-32557	Jun 14, 2022	An issue was discovered in Couchbase Server before 7.0.4 An issue was discovered in Couchbase Server before 7.0.4. The Index Service does not enforce authentication for TCP/TLS servers.	Couchbase Server
CVE-2022-32561	Jun 14, 2022	An issue was discovered in Couchbase Server before 6.6.5 and 7.x before 7.0.4 An issue was discovered in Couchbase Server before 6.6.5 and 7.x before 7.0.4. Previous mitigations for CVE-2018-15728 were found to be insufficient when it was discovered that diagnostic endpoints could still be accessed from the network.	Couchbase Server
CVE-2022-32559	Jun 14, 2022	An issue was discovered in Couchbase Server before 7.0.4 An issue was discovered in Couchbase Server before 7.0.4. Random HTTP requests lead to leaked metrics.	Couchbase Server
CVE-2022-32565	Jun 13, 2022	An issue was discovered in Couchbase Server before 7.0.4 An issue was discovered in Couchbase Server before 7.0.4. The Backup Service log leaks unredacted usernames and document ids.	Couchbase Server
CVE-2022-32562	Jun 13, 2022	An issue was discovered in Couchbase Server before 7.0.4 An issue was discovered in Couchbase Server before 7.0.4. Operations may succeed on a collection using stale RBAC permission.	Couchbase Server
CVE-2022-32192	Jun 13, 2022	Couchbase Server 5.x through 7.x before 7.0.4 exposes Sensitive Information to an Unauthorized Actor. Couchbase Server 5.x through 7.x before 7.0.4 exposes Sensitive Information to an Unauthorized Actor.	Couchbase Server
CVE-2022-32564	Jun 13, 2022	An issue was discovered in Couchbase Server before 7.0.4 An issue was discovered in Couchbase Server before 7.0.4. In couchbase-cli, server-eshell leaks the Cluster Manager cookie.	Couchbase Server
CVE-2022-32193	Jun 13, 2022	Couchbase Server 6.6.x through 7.x before 7.0.4 exposes Sensitive Information to an Unauthorized Actor. Couchbase Server 6.6.x through 7.x before 7.0.4 exposes Sensitive Information to an Unauthorized Actor.	Couchbase Server
CVE-2022-32558	Jun 13, 2022	An issue was discovered in Couchbase Server before 7.0.4 An issue was discovered in Couchbase Server before 7.0.4. Sample bucket loading may leak internal user passwords during a failure.	Couchbase Server
CVE-2022-32560	Jun 13, 2022	An issue was discovered in Couchbase Server before 7.0.4 An issue was discovered in Couchbase Server before 7.0.4. XDCR lacks role checking when changing internal settings.	Couchbase Server
CVE-2022-32563	Jun 10, 2022	An issue was discovered in Couchbase Sync Gateway 3.x before 3.0.2 An issue was discovered in Couchbase Sync Gateway 3.x before 3.0.2. Admin credentials are not verified when using X.509 client-certificate authentication from Sync Gateway to Couchbase Server. When Sync Gateway is configured to authenticate with Couchbase Server using X.509 client certificates, the admin credentials provided to the Admin REST API are ignored, resulting in privilege escalation for unauthenticated users. The Public REST API is not impacted by this issue. A workaround is to replace X.509 certificate based authentication with Username and Password authentication inside the bootstrap configuration.	Sync Gateway
CVE-2021-33504	Jun 02, 2022	Couchbase Server before 7.1.0 has Incorrect Access Control. Couchbase Server before 7.1.0 has Incorrect Access Control.	Couchbase Server
CVE-2022-31022	Jun 01, 2022	Bleve is a text indexing library for go Bleve is a text indexing library for go. Bleve includes HTTP utilities under bleve/http package, that are used by its sample application. These HTTP methods pave way for exploitation of a nodes filesystem where the bleve index resides, if the user has used bleves own HTTP (bleve/http) handlers for exposing the access to the indexes. For instance, the CreateIndexHandler (`http/index_create.go`) and DeleteIndexHandler (`http/index_delete.go`) enable an attacker to create a bleve index (directory structure) anywhere where the user running the server has the write permissions and to delete recursively any directory owned by the same user account. Users who have used the bleve/http package for exposing access to bleve index without the explicit handling for the Role Based Access Controls(RBAC) of the index assets would be impacted by this issue. Version 2.5.0 relocated the `http/` dir used _only_ by bleve-explorer to `blevesearch/bleve-explorer`, thereby addressing the issue. However, the http package is purely intended to be used for demonstration purposes. Bleve was never designed handle the RBACs, nor it was ever advertised to be used in that way. The collaborators of this project have decided to stay away from adding any authentication or authorization to bleve project at the moment. The bleve/http package is mainly for demonstration purposes and it lacks exhaustive validation of the user inputs as well as any authentication and authorization measures. It is recommended to not use bleve/http in production use cases.	Bleve
CVE-2022-26311	Mar 10, 2022	Couchbase Operator 2.2.x before 2.2.3 exposes Sensitive Information to an Unauthorized Actor Couchbase Operator 2.2.x before 2.2.3 exposes Sensitive Information to an Unauthorized Actor. Secrets are not redacted in logs collected from Kubernetes environments.	Cloud Native Operator
CVE-2021-43963	Dec 07, 2021	An issue was discovered in Couchbase Sync Gateway 2.7.0 through 2.8.2 An issue was discovered in Couchbase Sync Gateway 2.7.0 through 2.8.2. The bucket credentials used to read and write data in Couchbase Server were insecurely being stored in the metadata within sync documents written to the bucket. Users with read access could use these credentials to obtain write access. (This issue does not affect clusters where Sync Gateway is authenticated with X.509 client certificates. This issue also does not affect clusters where shared bucket access is not enabled on Sync Gateway.)	Sync Gateway
CVE-2021-37842	Nov 02, 2021	metakv in Couchbase Server 7.0.0 uses Cleartext for Storage of Sensitive Information metakv in Couchbase Server 7.0.0 uses Cleartext for Storage of Sensitive Information. Remote Cluster XDCR credentials can get leaked in debug logs. Config key tombstone purging was added in Couchbase Server 7.0.0. This issue happens when a config key, which is being logged, has a tombstone purger time-stamp attached to it.	Couchbase Server
CVE-2021-42763	Nov 02, 2021	Couchbase Server before 6.6.3 and 7.x before 7.0.2 stores Sensitive Information in Cleartext Couchbase Server before 6.6.3 and 7.x before 7.0.2 stores Sensitive Information in Cleartext. The issue occurs when the cluster manager forwards a HTTP request from the pluggable UI (query workbench etc) to the specific service. In the backtrace, the Basic Auth Header included in the HTTP request, has the "@" user credentials of the node processing the UI request.	Couchbase Server
CVE-2021-35943	Sep 29, 2021	Couchbase Server 6.5.x and 6.6.x through 6.6.2 has Incorrect Access Control Couchbase Server 6.5.x and 6.6.x through 6.6.2 has Incorrect Access Control. Externally managed users are not prevented from using an empty password, per RFC4513.	Couchbase Server
CVE-2021-35944	Sep 29, 2021	Couchbase Server 6.5.x, 6.6.x through 6.6.2, and 7.0.0 has a Buffer Overflow Couchbase Server 6.5.x, 6.6.x through 6.6.2, and 7.0.0 has a Buffer Overflow. A specially crafted network packet sent from an attacker can crash memcached.	Couchbase Server