CVE-2025-52490 | High | 7.3 | 2025-07-29 | An issue was discovered in Couchbase Sync Gateway before 3.2.6. In sgcollect_info_options.log and sync_gateway.log, there are cleartext passwords in redacted a… |
CVE-2025-49015 | Medium | 4.9 | 2025-06-18 | The Couchbase .NET SDK (client library) before 3.7.1 does not properly enable hostname verification for TLS certificates. In fact, the SDK was also using IP ad… |
CVE-2025-46619 | High | 7.6 | 2025-04-30 | A security issue has been discovered in Couchbase Server before 7.6.4 and fixed in v.7.6.4 and v.7.2.7 for Windows that could allow unauthorized access to sens… |
CVE-2024-56178 | Medium | 6.5 | 2025-01-27 | An issue was discovered in Couchbase Server 7.6.x through 7.6.3. A user with the security_admin_local role can create a new user in a group that has the admin… |
CVE-2024-25673 | Medium | 6.1 | 2024-09-19 | Couchbase Server 7.6.x before 7.6.2, 7.2.x before 7.2.6, and all earlier versions allows HTTP Host header injection. |
CVE-2024-37034 | Medium | 5.9 | 2024-07-26 | An issue was discovered in Couchbase Server before 7.2.5 and 7.6.0 before 7.6.1. It does not ensure that credentials are negotiated with the Key-Value (KV) ser… |
CVE-2023-43768 | High | 7.5 | 2024-03-27 | An issue was discovered in Couchbase Server 6.6.x through 7.2.0, before 7.1.5 and 7.2.1. Unauthenticated users may cause memcached to run out of memory via lar… |
CVE-2024-23302 | High | 7.5 | 2024-02-29 | Couchbase Server before 7.2.4 has a private key leak in goxdcr.log. |
CVE-2023-50437 | High | 8.6 | 2024-02-29 | An issue was discovered in Couchbase Server before 7.2.x before 7.2.4. otpCookie is shown with full admin on pools/default/serverGroups and engageCluster2. |
CVE-2023-50436 | Medium | 5.3 | 2024-02-29 | An issue was discovered in Couchbase Server before 7.2.4. ns_server admin credentials are leaked in encoded form in the diag.log file. The earliest affected ve… |
CVE-2023-49932 | Medium | 5.4 | 2024-02-29 | An issue was discovered in Couchbase Server before 7.2.4. An attacker can bypass SQL++ N1QL cURL host restrictions. |
CVE-2023-49931 | Critical | 9.8 | 2024-02-29 | An issue was discovered in Couchbase Server before 7.2.4. SQL++ cURL calls to /diag/eval are not sufficiently restricted. |
CVE-2023-49930 | Critical | 9.8 | 2024-02-29 | An issue was discovered in Couchbase Server before 7.2.4. cURL calls to /diag/eval are not sufficiently restricted. |
CVE-2023-45874 | Medium | 4.3 | 2024-02-29 | An issue was discovered in Couchbase Server through 7.2.2. A data reader may cause a denial of service (outage of reader threads). |
CVE-2023-43769 | Medium | 6.3 | 2024-02-29 | An issue was discovered in Couchbase Server through 7.1.4 before 7.1.5 and before 7.2.1. There are Unauthenticated RMI Service Ports Exposed in Analytics. |
CVE-2023-49338 | High | 7.5 | 2024-02-28 | Couchbase Server 7.1.x and 7.2.x before 7.2.4 does not require authentication for the /admin/stats and /admin/vitals endpoints on TCP port 8093 of localhost. |
CVE-2023-45873 | Medium | 6.5 | 2024-02-28 | An issue was discovered in Couchbase Server through 7.2.2. A data reader may cause a denial of service (application exist) because of the OOM killer. |
CVE-2023-50782 | High | 7.5 | 2024-02-05 | A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchan… |
CVE-2024-0519 | High | 8.8 | 2024-01-16 | Out of bounds memory access in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2023-36667 | High | 7.5 | 2023-11-08 | Couchbase Server 7.1.4 before 7.1.5 and 7.2.0 before 7.2.1 allows Directory Traversal. |
CVE-2023-45875 | High | 7.5 | 2023-11-08 | An issue was discovered in Couchbase Server 7.2.0. There is a private key leak in debug.log while adding a pre-7.0 node to a 7.2 cluster. |
CVE-2023-3079 | High | 8.8 | 2023-06-05 | Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi… |
CVE-2023-2033 | High | 8.8 | 2023-04-14 | Type confusion in V8 in Google Chrome prior to 112.0.5615.121 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi… |
CVE-2023-28470 | Medium | 5.3 | 2023-03-23 | In Couchbase Server 5 through 7 before 7.1.4, the nsstats endpoint is accessible without authentication. |
CVE-2023-25016 | High | 7.5 | 2023-02-06 | Couchbase Server before 6.6.6, 7.x before 7.0.5, and 7.1.x before 7.1.2 exposes Sensitive Information to an Unauthorized Actor. |
CVE-2022-42951 | High | 8.1 | 2023-02-06 | An issue was discovered in Couchbase Server 6.5.x and 6.6.x before 6.6.6, 7.x before 7.0.5, and 7.1.x before 7.1.2. During the start-up of a Couchbase Server n… |
CVE-2022-42950 | Medium | 4.9 | 2023-02-06 | An issue was discovered in Couchbase Server 7.x before 7.0.5 and 7.1.x before 7.1.2. A crafted HTTP REST request from an administrator account to the Couchbase… |
CVE-2022-32556 | High | 7.5 | 2022-07-21 | An issue was discovered in Couchbase Server before 7.0.4. A private key is leaked to the log files with certain crashes. |
CVE-2022-34826 | Medium | 5.9 | 2022-07-15 | In Couchbase Server 7.1.x before 7.1.1, an encrypted Private Key passphrase may be leaked in the logs. |
CVE-2022-33911 | Medium | 5.3 | 2022-07-12 | An issue was discovered in Couchbase Server 7.x before 7.0.4. Field names are not redacted in logged validation messages for Analytics Service. An Unauthorized… |
CVE-2022-33173 | High | 7.5 | 2022-07-12 | An algorithm-downgrade issue was discovered in Couchbase Server before 7.0.4. Analytics Remote Links may temporarily downgrade to non-TLS connection to determi… |
CVE-2022-32561 | Medium | 4.9 | 2022-06-14 | An issue was discovered in Couchbase Server before 6.6.5 and 7.x before 7.0.4. Previous mitigations for CVE-2018-15728 were found to be insufficient when it wa… |
CVE-2022-32559 | Critical | 9.1 | 2022-06-14 | An issue was discovered in Couchbase Server before 7.0.4. Random HTTP requests lead to leaked metrics. |
CVE-2022-32557 | High | 7.5 | 2022-06-14 | An issue was discovered in Couchbase Server before 7.0.4. The Index Service does not enforce authentication for TCP/TLS servers. |
CVE-2022-32565 | High | 7.5 | 2022-06-13 | An issue was discovered in Couchbase Server before 7.0.4. The Backup Service log leaks unredacted usernames and document ids. |
CVE-2022-32562 | High | 8.8 | 2022-06-13 | An issue was discovered in Couchbase Server before 7.0.4. Operations may succeed on a collection using stale RBAC permission. |
CVE-2022-32192 | High | 7.5 | 2022-06-13 | Couchbase Server 5.x through 7.x before 7.0.4 exposes Sensitive Information to an Unauthorized Actor. |
CVE-2022-32564 | High | 7.5 | 2022-06-13 | An issue was discovered in Couchbase Server before 7.0.4. In couchbase-cli, server-eshell leaks the Cluster Manager cookie. |
CVE-2022-32560 | High | 7.5 | 2022-06-13 | An issue was discovered in Couchbase Server before 7.0.4. XDCR lacks role checking when changing internal settings. |
CVE-2022-32558 | High | 7.5 | 2022-06-13 | An issue was discovered in Couchbase Server before 7.0.4. Sample bucket loading may leak internal user passwords during a failure. |
CVE-2022-32193 | Medium | 6.5 | 2022-06-13 | Couchbase Server 6.6.x through 7.x before 7.0.4 exposes Sensitive Information to an Unauthorized Actor. |
CVE-2022-32563 | Critical | 9.8 | 2022-06-10 | An issue was discovered in Couchbase Sync Gateway 3.x before 3.0.2. Admin credentials are not verified when using X.509 client-certificate authentication from… |
CVE-2021-33504 | Medium | 4.9 | 2022-06-02 | Couchbase Server before 7.1.0 has Incorrect Access Control. |
CVE-2022-31022 | Medium | 6.2 | 2022-06-01 | Bleve is a text indexing library for go. Bleve includes HTTP utilities under bleve/http package, that are used by its sample application. These HTTP methods pa… |
CVE-2022-26311 | High | 7.5 | 2022-03-10 | Couchbase Operator 2.2.x before 2.2.3 exposes Sensitive Information to an Unauthorized Actor. Secrets are not redacted in logs collected from Kubernetes enviro… |
CVE-2021-43963 | High | 8.1 | 2021-12-07 | An issue was discovered in Couchbase Sync Gateway 2.7.0 through 2.8.2. The bucket credentials used to read and write data in Couchbase Server were insecurely b… |
CVE-2021-42763 | High | 7.5 | 2021-11-02 | Couchbase Server before 6.6.3 and 7.x before 7.0.2 stores Sensitive Information in Cleartext. The issue occurs when the cluster manager forwards a HTTP request… |
CVE-2021-37842 | High | 7.5 | 2021-11-02 | metakv in Couchbase Server 7.0.0 uses Cleartext for Storage of Sensitive Information. Remote Cluster XDCR credentials can get leaked in debug logs. Config key… |
CVE-2021-35945 | High | 7.5 | 2021-09-29 | Couchbase Server 6.5.x, 6.6.0 through 6.6.2, and 7.0.0, has a Buffer Overflow. A specially crafted network packet sent from an attacker can crash memcached. |
CVE-2021-35944 | High | 7.5 | 2021-09-29 | Couchbase Server 6.5.x, 6.6.x through 6.6.2, and 7.0.0 has a Buffer Overflow. A specially crafted network packet sent from an attacker can crash memcached. |
CVE-2021-35943 | Critical | 9.8 | 2021-09-29 | Couchbase Server 6.5.x and 6.6.x through 6.6.2 has Incorrect Access Control. Externally managed users are not prevented from using an empty password, per RFC45… |
CVE-2021-25643 | Medium | 4.9 | 2021-05-26 | An issue was discovered in Couchbase Server 5.x and 6.x before 6.5.2 and 6.6.x before 6.6.2. Internal users with administrator privileges, @cbq-engine-cbauth a… |
CVE-2021-27924 | Medium | 5.9 | 2021-05-19 | An issue was discovered in Couchbase Server 6.x through 6.6.1. The Couchbase Server UI is insecurely logging session cookies in the logs. This allows for the i… |
CVE-2021-31158 | Medium | 6.5 | 2021-05-19 | In the Query Engine in Couchbase Server 6.5.x and 6.6.x through 6.6.1, Common Table Expression queries were not correctly checking the user's permissions, allo… |
CVE-2021-27925 | Medium | 4.4 | 2021-05-19 | An issue was discovered in Couchbase Server 6.5.x and 6.6.x through 6.6.1. When using the View Engine and Auditing is enabled, a crash condition can (depending… |
CVE-2021-25644 | High | 7.5 | 2021-05-19 | An issue was discovered in Couchbase Server 5.x and 6.x through 6.6.1 and 7.0.0 Beta. Incorrect commands to the REST API can result in leaked authentication in… |
CVE-2021-25645 | Medium | 4.4 | 2021-05-10 | An issue was discovered in Couchbase Server before 6.0.5, 6.1.x through 6.5.x before 6.5.2, and 6.6.x before 6.6.1. An internal user with administrator privile… |
CVE-2020-24719 | Critical | 9.8 | 2020-11-12 | Exposed Erlang Cookie could lead to Remote Command Execution (RCE) attack. Communication between Erlang nodes is done by exchanging a shared secret (aka "magic… |
CVE-2020-9042 | High | 8.8 | 2020-06-08 | In Couchbase Server 6.0, credentials cached by a browser can be used to perform a CSRF attack if an administrator has used their browser to check the results o… |
CVE-2020-9041 | High | 7.5 | 2020-06-08 | In Couchbase Server 6.0.3 and Couchbase Sync Gateway through 2.7.0, the Cluster management, views, query, and full-text search endpoints are vulnerable to the… |
CVE-2020-9040 | High | 7.5 | 2020-06-08 | Couchbase Server Java SDK before 2.7.1.1 allows a potential attacker to forge an SSL certificate and pose as the intended peer. An attacker can leverage this f… |
CVE-2020-9039 | Critical | 9.8 | 2020-02-22 | Couchbase Server 4.0.0, 4.1.0, 4.1.1, 4.5.0, 4.5.1, 4.6.0 through 4.6.5, 5.0.0, 5.1.1, 5.5.0 and 5.5.1 have Insecure Permissions for the projector and indexer… |
CVE-2019-11497 | High | 7.5 | 2019-09-10 | In Couchbase Server 5.0.0, when an invalid Remote Cluster Certificate was entered as part of the reference creation, XDCR did not parse and check the certifica… |
CVE-2019-11496 | Critical | 9.1 | 2019-09-10 | In versions of Couchbase Server prior to 5.0, the bucket named "default" was a special bucket that allowed read and write access without authentication. As par… |
CVE-2019-11495 | Critical | 9.8 | 2019-09-10 | In Couchbase Server 5.1.1, the cookie used for intra-node communication was not generated securely. Couchbase Server uses erlang:now() to seed the PRNG which r… |
CVE-2019-11467 | High | 7.5 | 2019-09-10 | In Couchbase Server 4.6.3 and 5.5.0, secondary indexing encodes the entries to be indexed using collatejson. When index entries contain certain characters like… |
CVE-2019-11466 | Medium | 5.3 | 2019-09-10 | In Couchbase Server 6.0.0 and 5.5.0, the eventing service exposes system diagnostic profile via an HTTP endpoint that does not require credentials on a port ea… |
CVE-2019-11465 | Medium | 5.3 | 2019-09-10 | An issue was discovered in Couchbase Server 5.5.x through 5.5.3 and 6.0.0. The Memcached "connections" stat block command emits a non-redacted username. The sy… |
CVE-2019-11464 | Medium | 6.1 | 2019-09-10 | Some enterprises require that REST API endpoints include security-related headers in REST responses. Headers such as X-Frame-Options and X-Content-Type-Options… |
CVE-2019-9039 | Critical | 9.8 | 2019-06-26 | In Couchbase Sync Gateway 2.1.2, an attacker with access to the Sync Gateway’s public REST API was able to issue additional N1QL statements and extract sensiti… |
CVE-2018-15728 | High | 8.8 | 2018-08-24 | Couchbase Server exposed the '/diag/eval' endpoint which by default is available on TCP/8091 and/or TCP/18091. Authenticated users that have 'Full Admin' role… |