Live › vulnerability › CVE-2026-107755
Go to dashboardApache CouchDB 3.5.2 and below does not filter credentials in the _replicator database, so an authenticated user can read the replication credentials of other users' replications. An attacker gets the stored usernames and passwords used by other users' replication jobs, which can reach other databases.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Deployments running Apache CouchDB 3.5.2 or earlier on any platform where more than one authenticated user can create or view replications. Single-user installations where only trusted operators create replications carry little practical exposure. Installations already on 3.5.3 or later are not affected.
No product ranges from the sources yet.
curl -s http://localhost:5984/ and look at the "version" field_replicator docs with curl -u admin:password http://localhost:5984/_replicator/_all_docs3.5.3, which fixes the issueEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Insufficient filtering of credentials in the _replicator database in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to read replication credentials of other users’ replications, not just their own.
Users are recommended to upgrade to version 3.5.3, which fixes this issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-107755")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.