Aggregates CVE and security vulnerability intelligence across all Couchbase-related products, including CVSS, EPSS, publication dates, and vulnerability intelligence data.
Historical issues mainly involve vendor risk path handling, vendor risk buffer overflow, and vendor risk csrf and related problems; some flaws may lead to vendor impact file overwrite and vendor impact application crash.
| CVE | Summary | Source | Max CVSS | EPSS % | Published | Updated |
|---|---|---|---|---|---|---|
| CVE-2022-32193 | Couchbase Server 6.6.x through 7.x before 7.0.4 exposes Sensitive Information to an Unauthorized Actor. | [email protected] | 6.5 | 0.68% | 2022-06-13 | 2026-06-17 |
| CVE-2022-32563 | An issue was discovered in Couchbase Sync Gateway 3.x before 3.0.2. Admin credentials are not verified when using X.509 client-certificate authentication from Sync Gateway to Couchbase Server. When Sync Gateway is configured to authenticate with Couchbase Server using X.509 client certificates, the admin credentials provided to the Admin REST API are ignored, resulting in privilege escalation for unauthenticated users. The Public REST API is not impacted by this issue. A workaround is to replace | [email protected] | 9.8 | 0.76% | 2022-06-10 | 2026-06-17 |
| CVE-2021-33504 | Couchbase Server before 7.1.0 has Incorrect Access Control. | [email protected] | 4.9 | 0.70% | 2022-06-02 | 2026-06-16 |
| CVE-2022-31022 | Bleve is a text indexing library for go. Bleve includes HTTP utilities under bleve/http package, that are used by its sample application. These HTTP methods pave way for exploitation of a node’s filesystem where the bleve index resides, if the user has used bleve’s own HTTP (bleve/http) handlers for exposing the access to the indexes. For instance, the CreateIndexHandler (`http/index_create.go`) and DeleteIndexHandler (`http/index_delete.go`) enable an attacker to create a bleve index (directory | [email protected] | 6.2 | 0.33% | 2022-06-01 | 2026-06-17 |
| CVE-2022-26311 | Couchbase Operator 2.2.x before 2.2.3 exposes Sensitive Information to an Unauthorized Actor. Secrets are not redacted in logs collected from Kubernetes environments. | [email protected] | 7.5 | 1.11% | 2022-03-10 | 2026-06-17 |
| CVE-2021-43963 | An issue was discovered in Couchbase Sync Gateway 2.7.0 through 2.8.2. The bucket credentials used to read and write data in Couchbase Server were insecurely being stored in the metadata within sync documents written to the bucket. Users with read access could use these credentials to obtain write access. (This issue does not affect clusters where Sync Gateway is authenticated with X.509 client certificates. This issue also does not affect clusters where shared bucket access is not enabled on Sy | [email protected] | 8.1 | 0.50% | 2021-12-07 | 2026-06-17 |
| CVE-2021-42763 | Couchbase Server before 6.6.3 and 7.x before 7.0.2 stores Sensitive Information in Cleartext. The issue occurs when the cluster manager forwards a HTTP request from the pluggable UI (query workbench etc) to the specific service. In the backtrace, the Basic Auth Header included in the HTTP request, has the "@" user credentials of the node processing the UI request. | [email protected] | 7.5 | 0.59% | 2021-11-02 | 2026-06-17 |
| CVE-2021-37842 | metakv in Couchbase Server 7.0.0 uses Cleartext for Storage of Sensitive Information. Remote Cluster XDCR credentials can get leaked in debug logs. Config key tombstone purging was added in Couchbase Server 7.0.0. This issue happens when a config key, which is being logged, has a tombstone purger time-stamp attached to it. | [email protected] | 7.5 | 0.59% | 2021-11-02 | 2026-06-17 |
| CVE-2021-35945 | Couchbase Server 6.5.x, 6.6.0 through 6.6.2, and 7.0.0, has a Buffer Overflow. A specially crafted network packet sent from an attacker can crash memcached. | [email protected] | 7.5 | 1.06% | 2021-09-29 | 2026-06-16 |
| CVE-2021-35944 | Couchbase Server 6.5.x, 6.6.x through 6.6.2, and 7.0.0 has a Buffer Overflow. A specially crafted network packet sent from an attacker can crash memcached. | [email protected] | 7.5 | 1.06% | 2021-09-29 | 2026-06-16 |
| CVE-2021-35943 | Couchbase Server 6.5.x and 6.6.x through 6.6.2 has Incorrect Access Control. Externally managed users are not prevented from using an empty password, per RFC4513. | [email protected] | 9.8 | 1.03% | 2021-09-29 | 2026-06-16 |
| CVE-2021-25643 | An issue was discovered in Couchbase Server 5.x and 6.x before 6.5.2 and 6.6.x before 6.6.2. Internal users with administrator privileges, @cbq-engine-cbauth and @index-cbauth, leak credentials in cleartext in the indexer.log file when they make a /listCreateTokens, /listRebalanceTokens, or /listMetadataTokens call. | [email protected] | 4.9 | 0.50% | 2021-05-26 | 2026-06-16 |
| CVE-2021-27924 | An issue was discovered in Couchbase Server 6.x through 6.6.1. The Couchbase Server UI is insecurely logging session cookies in the logs. This allows for the impersonation of a user if the log files are obtained by an attacker before a session cookie expires. | [email protected] | 5.9 | 0.55% | 2021-05-19 | 2026-06-16 |
| CVE-2021-31158 | In the Query Engine in Couchbase Server 6.5.x and 6.6.x through 6.6.1, Common Table Expression queries were not correctly checking the user's permissions, allowing read-access to resources beyond what those users were explicitly allowed to access. | [email protected] | 6.5 | 0.70% | 2021-05-19 | 2026-06-16 |
| CVE-2021-27925 | An issue was discovered in Couchbase Server 6.5.x and 6.6.x through 6.6.1. When using the View Engine and Auditing is enabled, a crash condition can (depending on a race condition) cause an internal user with administrator privileges, @ns_server, to have its credentials leaked in cleartext in the ns_server.info.log file. | [email protected] | 4.4 | 0.53% | 2021-05-19 | 2026-06-16 |
| CVE-2021-25644 | An issue was discovered in Couchbase Server 5.x and 6.x through 6.6.1 and 7.0.0 Beta. Incorrect commands to the REST API can result in leaked authentication information being stored in cleartext in the debug.log and info.log files, and is also shown in the UI visible to administrators. | [email protected] | 7.5 | 0.64% | 2021-05-19 | 2026-06-16 |
| CVE-2021-25645 | An issue was discovered in Couchbase Server before 6.0.5, 6.1.x through 6.5.x before 6.5.2, and 6.6.x before 6.6.1. An internal user with administrator privileges, @ns_server, leaks credentials in cleartext in the cbcollect_info.log, debug.log, ns_couchdb.log, indexer.log, and stats.log files. NOTE: updating the product does not automatically address leaks that occurred in the past. | [email protected] | 4.4 | 0.17% | 2021-05-10 | 2026-06-16 |
| CVE-2020-24719 | Exposed Erlang Cookie could lead to Remote Command Execution (RCE) attack. Communication between Erlang nodes is done by exchanging a shared secret (aka "magic cookie"). There are cases where the magic cookie is included in the content of the logs. An attacker can use the cookie to attach to an Erlang node and run OS level commands on the system running the Erlang node. Affects version: 6.5.1. Fix version: 6.6.0. | [email protected] | 9.8 | 23.30% | 2020-11-12 | 2026-06-16 |
| CVE-2020-9042 | In Couchbase Server 6.0, credentials cached by a browser can be used to perform a CSRF attack if an administrator has used their browser to check the results of a REST API request. | [email protected] | 8.8 | 0.58% | 2020-06-08 | 2026-06-16 |
| CVE-2020-9041 | In Couchbase Server 6.0.3 and Couchbase Sync Gateway through 2.7.0, the Cluster management, views, query, and full-text search endpoints are vulnerable to the Slowloris denial-of-service attack because they don't more aggressively terminate slow connections. | [email protected] | 7.5 | 1.28% | 2020-06-08 | 2026-06-16 |