CVE Daily – Couchbase Server (High+Critical) https://cvedaily.com/pages/tags/couchbase-server.html CVE Daily – Couchbase Server (High+Critical) en Wed, 03 Jun 2026 21:27:06 +0000 [High] CVE-2025-46619 – A security issue has been discovered in Couchbase Server before 7.6.4 and fixed ... https://nvd.nist.gov/vuln/detail/CVE-2025-46619 https://nvd.nist.gov/vuln/detail/CVE-2025-46619 Wed, 30 Apr 2025 18:15:48 +0000 High CVE-2025-46619

A security issue has been discovered in Couchbase Server before 7.6.4 and fixed in v.7.6.4 and v.7.2.7 for Windows that could allow unauthorized access to sensitive files. Depending on the level of privileges, this vulnerability may grant access to files such as /etc/passwd or /etc/shadow.

CVSS: 7.6 · CWE: CWE-284

View on NVD

]]> [High] CVE-2023-43768 – An issue was discovered in Couchbase Server 6.6.x through 7.2.0, before 7.1.5 an... https://nvd.nist.gov/vuln/detail/CVE-2023-43768 https://nvd.nist.gov/vuln/detail/CVE-2023-43768 Wed, 27 Mar 2024 07:15:48 +0000 High CVE-2023-43768

An issue was discovered in Couchbase Server 6.6.x through 7.2.0, before 7.1.5 and 7.2.1. Unauthenticated users may cause memcached to run out of memory via large commands.

CVSS: 7.5 · CWE: CWE-770

View on NVD

]]> [High] CVE-2024-23302 – Couchbase Server before 7.2.4 has a private key leak in goxdcr.log. https://nvd.nist.gov/vuln/detail/CVE-2024-23302 https://nvd.nist.gov/vuln/detail/CVE-2024-23302 Thu, 29 Feb 2024 01:44:08 +0000 High CVE-2024-23302

Couchbase Server before 7.2.4 has a private key leak in goxdcr.log.

CVSS: 7.5 · CWE: CWE-200

View on NVD

]]> [High] CVE-2023-50437 – An issue was discovered in Couchbase Server before 7.2.x before 7.2.4. otpCookie... https://nvd.nist.gov/vuln/detail/CVE-2023-50437 https://nvd.nist.gov/vuln/detail/CVE-2023-50437 Thu, 29 Feb 2024 01:42:00 +0000 High CVE-2023-50437

An issue was discovered in Couchbase Server before 7.2.x before 7.2.4. otpCookie is shown with full admin on pools/default/serverGroups and engageCluster2.

CVSS: 8.6 · CWE: CWE-266

View on NVD

]]> [Critical] CVE-2023-49931 – An issue was discovered in Couchbase Server before 7.2.4. SQL++ cURL calls to /d... https://nvd.nist.gov/vuln/detail/CVE-2023-49931 https://nvd.nist.gov/vuln/detail/CVE-2023-49931 Thu, 29 Feb 2024 01:41:40 +0000 Critical CVE-2023-49931

An issue was discovered in Couchbase Server before 7.2.4. SQL++ cURL calls to /diag/eval are not sufficiently restricted.

CVSS: 9.8 · CWE: CWE-284

View on NVD

]]> [Critical] CVE-2023-49930 – An issue was discovered in Couchbase Server before 7.2.4. cURL calls to /diag/ev... https://nvd.nist.gov/vuln/detail/CVE-2023-49930 https://nvd.nist.gov/vuln/detail/CVE-2023-49930 Thu, 29 Feb 2024 01:41:40 +0000 Critical CVE-2023-49930

An issue was discovered in Couchbase Server before 7.2.4. cURL calls to /diag/eval are not sufficiently restricted.

CVSS: 9.8 · CWE: CWE-284

View on NVD

]]> [High] CVE-2023-49338 – Couchbase Server 7.1.x and 7.2.x before 7.2.4 does not require authentication fo... https://nvd.nist.gov/vuln/detail/CVE-2023-49338 https://nvd.nist.gov/vuln/detail/CVE-2023-49338 Wed, 28 Feb 2024 22:15:26 +0000 High CVE-2023-49338

Couchbase Server 7.1.x and 7.2.x before 7.2.4 does not require authentication for the /admin/stats and /admin/vitals endpoints on TCP port 8093 of localhost.

CVSS: 7.5 · CWE: CWE-276

View on NVD

]]> [High] CVE-2023-36667 – Couchbase Server 7.1.4 before 7.1.5 and 7.2.0 before 7.2.1 allows Directory Trav... https://nvd.nist.gov/vuln/detail/CVE-2023-36667 https://nvd.nist.gov/vuln/detail/CVE-2023-36667 Wed, 08 Nov 2023 22:15:08 +0000 High CVE-2023-36667

Couchbase Server 7.1.4 before 7.1.5 and 7.2.0 before 7.2.1 allows Directory Traversal.

CVSS: 7.5 · CWE: CWE-22

View on NVD

]]> [High] CVE-2023-45875 – An issue was discovered in Couchbase Server 7.2.0. There is a private key leak i... https://nvd.nist.gov/vuln/detail/CVE-2023-45875 https://nvd.nist.gov/vuln/detail/CVE-2023-45875 Wed, 08 Nov 2023 21:15:08 +0000 High CVE-2023-45875

An issue was discovered in Couchbase Server 7.2.0. There is a private key leak in debug.log while adding a pre-7.0 node to a 7.2 cluster.

CVSS: 7.5 · CWE: CWE-200

View on NVD

]]> [High] CVE-2023-25016 – Couchbase Server before 6.6.6, 7.x before 7.0.5, and 7.1.x before 7.1.2 exposes ... https://nvd.nist.gov/vuln/detail/CVE-2023-25016 https://nvd.nist.gov/vuln/detail/CVE-2023-25016 Mon, 06 Feb 2023 21:15:09 +0000 High CVE-2023-25016

Couchbase Server before 6.6.6, 7.x before 7.0.5, and 7.1.x before 7.1.2 exposes Sensitive Information to an Unauthorized Actor.

CVSS: 7.5 · CWE: CWE-319

View on NVD

]]> [High] CVE-2022-42951 – An issue was discovered in Couchbase Server 6.5.x and 6.6.x before 6.6.6, 7.x be... https://nvd.nist.gov/vuln/detail/CVE-2022-42951 https://nvd.nist.gov/vuln/detail/CVE-2022-42951 Mon, 06 Feb 2023 21:15:09 +0000 High CVE-2022-42951

An issue was discovered in Couchbase Server 6.5.x and 6.6.x before 6.6.6, 7.x before 7.0.5, and 7.1.x before 7.1.2. During the start-up of a Couchbase Server node, there is a small window of time (before the cluster management authentication has started) where an attacker can connect to the cluster manager using default credentials.

CVSS: 8.1 · CWE: CWE-287

View on NVD

]]> [High] CVE-2022-32556 – An issue was discovered in Couchbase Server before 7.0.4. A private key is leake... https://nvd.nist.gov/vuln/detail/CVE-2022-32556 https://nvd.nist.gov/vuln/detail/CVE-2022-32556 Thu, 21 Jul 2022 12:15:08 +0000 High CVE-2022-32556

An issue was discovered in Couchbase Server before 7.0.4. A private key is leaked to the log files with certain crashes.

CVSS: 7.5 · CWE: CWE-532

View on NVD

]]> [High] CVE-2022-33173 – An algorithm-downgrade issue was discovered in Couchbase Server before 7.0.4. An... https://nvd.nist.gov/vuln/detail/CVE-2022-33173 https://nvd.nist.gov/vuln/detail/CVE-2022-33173 Tue, 12 Jul 2022 14:15:16 +0000 High CVE-2022-33173

An algorithm-downgrade issue was discovered in Couchbase Server before 7.0.4. Analytics Remote Links may temporarily downgrade to non-TLS connection to determine the TLS port number, using SCRAM-SHA instead.

CVSS: 7.5 · CWE: N/A

View on NVD

]]> [Critical] CVE-2022-32559 – An issue was discovered in Couchbase Server before 7.0.4. Random HTTP requests l... https://nvd.nist.gov/vuln/detail/CVE-2022-32559 https://nvd.nist.gov/vuln/detail/CVE-2022-32559 Tue, 14 Jun 2022 17:15:08 +0000 Critical CVE-2022-32559

An issue was discovered in Couchbase Server before 7.0.4. Random HTTP requests lead to leaked metrics.

CVSS: 9.1 · CWE: CWE-770

View on NVD

]]> [High] CVE-2022-32557 – An issue was discovered in Couchbase Server before 7.0.4. The Index Service does... https://nvd.nist.gov/vuln/detail/CVE-2022-32557 https://nvd.nist.gov/vuln/detail/CVE-2022-32557 Tue, 14 Jun 2022 17:15:08 +0000 High CVE-2022-32557

An issue was discovered in Couchbase Server before 7.0.4. The Index Service does not enforce authentication for TCP/TLS servers.

CVSS: 7.5 · CWE: CWE-306

View on NVD

]]> [High] CVE-2022-32565 – An issue was discovered in Couchbase Server before 7.0.4. The Backup Service log... https://nvd.nist.gov/vuln/detail/CVE-2022-32565 https://nvd.nist.gov/vuln/detail/CVE-2022-32565 Mon, 13 Jun 2022 23:15:08 +0000 High CVE-2022-32565

An issue was discovered in Couchbase Server before 7.0.4. The Backup Service log leaks unredacted usernames and document ids.

CVSS: 7.5 · CWE: CWE-532

View on NVD

]]> [High] CVE-2022-32562 – An issue was discovered in Couchbase Server before 7.0.4. Operations may succeed... https://nvd.nist.gov/vuln/detail/CVE-2022-32562 https://nvd.nist.gov/vuln/detail/CVE-2022-32562 Mon, 13 Jun 2022 23:15:08 +0000 High CVE-2022-32562

An issue was discovered in Couchbase Server before 7.0.4. Operations may succeed on a collection using stale RBAC permission.

CVSS: 8.8 · CWE: CWE-276

View on NVD

]]> [High] CVE-2022-32192 – Couchbase Server 5.x through 7.x before 7.0.4 exposes Sensitive Information to a... https://nvd.nist.gov/vuln/detail/CVE-2022-32192 https://nvd.nist.gov/vuln/detail/CVE-2022-32192 Mon, 13 Jun 2022 23:15:08 +0000 High CVE-2022-32192

Couchbase Server 5.x through 7.x before 7.0.4 exposes Sensitive Information to an Unauthorized Actor.

CVSS: 7.5 · CWE: CWE-200

View on NVD

]]> [High] CVE-2022-32564 – An issue was discovered in Couchbase Server before 7.0.4. In couchbase-cli, serv... https://nvd.nist.gov/vuln/detail/CVE-2022-32564 https://nvd.nist.gov/vuln/detail/CVE-2022-32564 Mon, 13 Jun 2022 21:15:08 +0000 High CVE-2022-32564

An issue was discovered in Couchbase Server before 7.0.4. In couchbase-cli, server-eshell leaks the Cluster Manager cookie.

CVSS: 7.5 · CWE: N/A

View on NVD

]]> [High] CVE-2022-32560 – An issue was discovered in Couchbase Server before 7.0.4. XDCR lacks role checki... https://nvd.nist.gov/vuln/detail/CVE-2022-32560 https://nvd.nist.gov/vuln/detail/CVE-2022-32560 Mon, 13 Jun 2022 21:15:08 +0000 High CVE-2022-32560

An issue was discovered in Couchbase Server before 7.0.4. XDCR lacks role checking when changing internal settings.

CVSS: 7.5 · CWE: CWE-862

View on NVD

]]> [High] CVE-2022-32558 – An issue was discovered in Couchbase Server before 7.0.4. Sample bucket loading ... https://nvd.nist.gov/vuln/detail/CVE-2022-32558 https://nvd.nist.gov/vuln/detail/CVE-2022-32558 Mon, 13 Jun 2022 21:15:07 +0000 High CVE-2022-32558

An issue was discovered in Couchbase Server before 7.0.4. Sample bucket loading may leak internal user passwords during a failure.

CVSS: 7.5 · CWE: N/A

View on NVD

]]> [Critical] CVE-2022-32563 – An issue was discovered in Couchbase Sync Gateway 3.x before 3.0.2. Admin creden... https://nvd.nist.gov/vuln/detail/CVE-2022-32563 https://nvd.nist.gov/vuln/detail/CVE-2022-32563 Fri, 10 Jun 2022 12:15:07 +0000 Critical CVE-2022-32563

An issue was discovered in Couchbase Sync Gateway 3.x before 3.0.2. Admin credentials are not verified when using X.509 client-certificate authentication from Sync Gateway to Couchbase Server. When Sync Gateway is configured to authenticate with Couchbase Server using X.509 client certificates, the admin credentials provided to the Admin REST API are ignored, resulting in privilege escalation for…

CVSS: 9.8 · CWE: CWE-295

View on NVD

]]> [High] CVE-2021-43963 – An issue was discovered in Couchbase Sync Gateway 2.7.0 through 2.8.2. The bucke... https://nvd.nist.gov/vuln/detail/CVE-2021-43963 https://nvd.nist.gov/vuln/detail/CVE-2021-43963 Tue, 07 Dec 2021 22:15:07 +0000 High CVE-2021-43963

An issue was discovered in Couchbase Sync Gateway 2.7.0 through 2.8.2. The bucket credentials used to read and write data in Couchbase Server were insecurely being stored in the metadata within sync documents written to the bucket. Users with read access could use these credentials to obtain write access. (This issue does not affect clusters where Sync Gateway is authenticated with X.509 client c…

CVSS: 8.1 · CWE: CWE-200

View on NVD

]]> [High] CVE-2021-42763 – Couchbase Server before 6.6.3 and 7.x before 7.0.2 stores Sensitive Information ... https://nvd.nist.gov/vuln/detail/CVE-2021-42763 https://nvd.nist.gov/vuln/detail/CVE-2021-42763 Tue, 02 Nov 2021 12:15:07 +0000 High CVE-2021-42763

Couchbase Server before 6.6.3 and 7.x before 7.0.2 stores Sensitive Information in Cleartext. The issue occurs when the cluster manager forwards a HTTP request from the pluggable UI (query workbench etc) to the specific service. In the backtrace, the Basic Auth Header included in the HTTP request, has the "@" user credentials of the node processing the UI request.

CVSS: 7.5 · CWE: CWE-312

View on NVD

]]> [High] CVE-2021-37842 – metakv in Couchbase Server 7.0.0 uses Cleartext for Storage of Sensitive Informa... https://nvd.nist.gov/vuln/detail/CVE-2021-37842 https://nvd.nist.gov/vuln/detail/CVE-2021-37842 Tue, 02 Nov 2021 12:15:07 +0000 High CVE-2021-37842

metakv in Couchbase Server 7.0.0 uses Cleartext for Storage of Sensitive Information. Remote Cluster XDCR credentials can get leaked in debug logs. Config key tombstone purging was added in Couchbase Server 7.0.0. This issue happens when a config key, which is being logged, has a tombstone purger time-stamp attached to it.

CVSS: 7.5 · CWE: CWE-312

View on NVD

]]> [High] CVE-2021-35945 – Couchbase Server 6.5.x, 6.6.0 through 6.6.2, and 7.0.0, has a Buffer Overflow. A... https://nvd.nist.gov/vuln/detail/CVE-2021-35945 https://nvd.nist.gov/vuln/detail/CVE-2021-35945 Wed, 29 Sep 2021 20:15:08 +0000 High CVE-2021-35945

Couchbase Server 6.5.x, 6.6.0 through 6.6.2, and 7.0.0, has a Buffer Overflow. A specially crafted network packet sent from an attacker can crash memcached.

CVSS: 7.5 · CWE: CWE-120

View on NVD

]]> [High] CVE-2021-35944 – Couchbase Server 6.5.x, 6.6.x through 6.6.2, and 7.0.0 has a Buffer Overflow. A ... https://nvd.nist.gov/vuln/detail/CVE-2021-35944 https://nvd.nist.gov/vuln/detail/CVE-2021-35944 Wed, 29 Sep 2021 20:15:08 +0000 High CVE-2021-35944

Couchbase Server 6.5.x, 6.6.x through 6.6.2, and 7.0.0 has a Buffer Overflow. A specially crafted network packet sent from an attacker can crash memcached.

CVSS: 7.5 · CWE: CWE-120

View on NVD

]]> [Critical] CVE-2021-35943 – Couchbase Server 6.5.x and 6.6.x through 6.6.2 has Incorrect Access Control. Ext... https://nvd.nist.gov/vuln/detail/CVE-2021-35943 https://nvd.nist.gov/vuln/detail/CVE-2021-35943 Wed, 29 Sep 2021 20:15:08 +0000 Critical CVE-2021-35943

Couchbase Server 6.5.x and 6.6.x through 6.6.2 has Incorrect Access Control. Externally managed users are not prevented from using an empty password, per RFC4513.

CVSS: 9.8 · CWE: CWE-287

View on NVD

]]> [High] CVE-2021-25644 – An issue was discovered in Couchbase Server 5.x and 6.x through 6.6.1 and 7.0.0 ... https://nvd.nist.gov/vuln/detail/CVE-2021-25644 https://nvd.nist.gov/vuln/detail/CVE-2021-25644 Wed, 19 May 2021 19:15:08 +0000 High CVE-2021-25644

An issue was discovered in Couchbase Server 5.x and 6.x through 6.6.1 and 7.0.0 Beta. Incorrect commands to the REST API can result in leaked authentication information being stored in cleartext in the debug.log and info.log files, and is also shown in the UI visible to administrators.

CVSS: 7.5 · CWE: CWE-312

View on NVD

]]> [High] CVE-2020-9042 – In Couchbase Server 6.0, credentials cached by a browser can be used to perform ... https://nvd.nist.gov/vuln/detail/CVE-2020-9042 https://nvd.nist.gov/vuln/detail/CVE-2020-9042 Mon, 08 Jun 2020 16:15:10 +0000 High CVE-2020-9042

In Couchbase Server 6.0, credentials cached by a browser can be used to perform a CSRF attack if an administrator has used their browser to check the results of a REST API request.

CVSS: 8.8 · CWE: CWE-352

View on NVD

]]> [High] CVE-2020-9041 – In Couchbase Server 6.0.3 and Couchbase Sync Gateway through 2.7.0, the Cluster ... https://nvd.nist.gov/vuln/detail/CVE-2020-9041 https://nvd.nist.gov/vuln/detail/CVE-2020-9041 Mon, 08 Jun 2020 16:15:10 +0000 High CVE-2020-9041

In Couchbase Server 6.0.3 and Couchbase Sync Gateway through 2.7.0, the Cluster management, views, query, and full-text search endpoints are vulnerable to the Slowloris denial-of-service attack because they don't more aggressively terminate slow connections.

CVSS: 7.5 · CWE: CWE-404

View on NVD

]]> [High] CVE-2020-9040 – Couchbase Server Java SDK before 2.7.1.1 allows a potential attacker to forge an... https://nvd.nist.gov/vuln/detail/CVE-2020-9040 https://nvd.nist.gov/vuln/detail/CVE-2020-9040 Mon, 08 Jun 2020 16:15:10 +0000 High CVE-2020-9040

Couchbase Server Java SDK before 2.7.1.1 allows a potential attacker to forge an SSL certificate and pose as the intended peer. An attacker can leverage this flaw by crafting a cryptographically valid certificate that will be accepted by Java SDK's Netty component due to missing hostname verification.

CVSS: 7.5 · CWE: CWE-295

View on NVD

]]> [Critical] CVE-2020-9039 – Couchbase Server 4.0.0, 4.1.0, 4.1.1, 4.5.0, 4.5.1, 4.6.0 through 4.6.5, 5.0.0, ... https://nvd.nist.gov/vuln/detail/CVE-2020-9039 https://nvd.nist.gov/vuln/detail/CVE-2020-9039 Sat, 22 Feb 2020 02:15:10 +0000 Critical CVE-2020-9039

Couchbase Server 4.0.0, 4.1.0, 4.1.1, 4.5.0, 4.5.1, 4.6.0 through 4.6.5, 5.0.0, 5.1.1, 5.5.0 and 5.5.1 have Insecure Permissions for the projector and indexer REST endpoints (they allow unauthenticated access).The /settings REST endpoint exposed by the projector process is an endpoint that administrators can use for various tasks such as updating configuration and collecting performance profiles.…

CVSS: 9.8 · CWE: CWE-276

View on NVD

]]> [High] CVE-2019-11497 – In Couchbase Server 5.0.0, when an invalid Remote Cluster Certificate was entere... https://nvd.nist.gov/vuln/detail/CVE-2019-11497 https://nvd.nist.gov/vuln/detail/CVE-2019-11497 Tue, 10 Sep 2019 18:15:12 +0000 High CVE-2019-11497

In Couchbase Server 5.0.0, when an invalid Remote Cluster Certificate was entered as part of the reference creation, XDCR did not parse and check the certificate signature. It then accepted the invalid certificate and attempted to use it to establish future connections to the remote cluster. This has been fixed in version 5.5.0. XDCR now checks the validity of the certificate thoroughly and preve…

CVSS: 7.5 · CWE: CWE-295

View on NVD

]]> [Critical] CVE-2019-11496 – In versions of Couchbase Server prior to 5.0, the bucket named "default" was a s... https://nvd.nist.gov/vuln/detail/CVE-2019-11496 https://nvd.nist.gov/vuln/detail/CVE-2019-11496 Tue, 10 Sep 2019 18:15:12 +0000 Critical CVE-2019-11496

In versions of Couchbase Server prior to 5.0, the bucket named "default" was a special bucket that allowed read and write access without authentication. As part of 5.0, the behavior of all buckets including "default" were changed to only allow access by authenticated users with sufficient authorization. However, users were allowed unauthenticated and unauthorized access to the "default" bucket if…

CVSS: 9.1 · CWE: CWE-306

View on NVD

]]> [Critical] CVE-2019-11495 – In Couchbase Server 5.1.1, the cookie used for intra-node communication was not ... https://nvd.nist.gov/vuln/detail/CVE-2019-11495 https://nvd.nist.gov/vuln/detail/CVE-2019-11495 Tue, 10 Sep 2019 18:15:12 +0000 Critical CVE-2019-11495

In Couchbase Server 5.1.1, the cookie used for intra-node communication was not generated securely. Couchbase Server uses erlang:now() to seed the PRNG which results in a small search space for potential random seeds that could then be used to brute force the cookie and execute code against a remote system. This has been fixed in version 6.0.0.

CVSS: 9.8 · CWE: CWE-335

View on NVD

]]> [High] CVE-2019-11467 – In Couchbase Server 4.6.3 and 5.5.0, secondary indexing encodes the entries to b... https://nvd.nist.gov/vuln/detail/CVE-2019-11467 https://nvd.nist.gov/vuln/detail/CVE-2019-11467 Tue, 10 Sep 2019 18:15:12 +0000 High CVE-2019-11467

In Couchbase Server 4.6.3 and 5.5.0, secondary indexing encodes the entries to be indexed using collatejson. When index entries contain certain characters like \t, <, >, it caused buffer overrun as encoded string would be much larger than accounted for, causing indexer service to crash and restart. This has been remedied in versions 5.1.2 and 5.5.2 to ensure buffer always grows as needed for any…

CVSS: 7.5 · CWE: CWE-119

View on NVD

]]> [High] CVE-2018-15728 – Couchbase Server exposed the '/diag/eval' endpoint which by default is available... https://nvd.nist.gov/vuln/detail/CVE-2018-15728 https://nvd.nist.gov/vuln/detail/CVE-2018-15728 Fri, 24 Aug 2018 19:29:02 +0000 High CVE-2018-15728

Couchbase Server exposed the '/diag/eval' endpoint which by default is available on TCP/8091 and/or TCP/18091. Authenticated users that have 'Full Admin' role assigned could send arbitrary Erlang code to the 'diag/eval' endpoint of the API and the code would subsequently be executed in the underlying operating system with privileges of the user which was used to start Couchbase. Affects Version:…

CVSS: 8.8 · CWE: CWE-94

View on NVD

]]>