{"id":"CVE-2026-107755","kind":"vulnerability","aliases":["CVE-2026-107755"],"related":[],"title":"Apache CouchDB: replicator database leaks other users' replication credentials","description":"Insufficient filtering of credentials in the _replicator database in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to read replication credentials of other users’ replications, not just their own.\n\nUsers are recommended to upgrade to version 3.5.3, which fixes this issue.","summary":"Apache CouchDB 3.5.2 and below does not filter credentials in the _replicator database, so an authenticated user can read the replication credentials of other users' replications. An attacker gets the stored usernames and passwords used by other users' replication jobs, which can reach other databases.","severity":"medium","cvss":6.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["couchdb","multi-user","package","self-hosted"],"not_affected_if":["default-config","single-user"],"how_to_check":"- Check the installed CouchDB version with `curl -s http://localhost:5984/` and look at the \"version\" field\n- Confirm whether multiple users create replications by listing `_replicator` docs with `curl -u admin:password http://localhost:5984/_replicator/_all_docs`","fix":"- Upgrade Apache CouchDB to `3.5.3`, which fixes the issue\n- Rotate credentials used in existing replication documents if other users could have read them","status":"open","published_at":"2026-10-20T16:16:59+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T04:05:46+00:00","updated_at":"2026-10-25T04:05:46+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:05:46Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache CouchDB to `3.5.3`, which fixes the issue\n- Rotate credentials used in existing replication documents if other users could have read them","reach":"network","title":"Apache CouchDB: replicator database leaks other users' replication credentials","impact":"medium","summary":"Apache CouchDB 3.5.2 and below does not filter credentials in the _replicator database, so an authenticated user can read the replication credentials of other users' replications. An attacker gets the stored usernames and passwords used by other users' replication jobs, which can reach other databases.","category":"package","nicknames":[],"who_cares":["couchdb","self-hosted","multi-user"],"confidence":0.7,"needs_auth":"yes","worst_case":"Other users' replication passwords readable, enabling access to their databases","analyst_note":"","how_to_check":"- Check the installed CouchDB version with `curl -s http://localhost:5984/` and look at the \"version\" field\n- Confirm whether multiple users create replications by listing `_replicator` docs with `curl -u admin:password http://localhost:5984/_replicator/_all_docs`","needs_analyst":false,"not_affected_if":["single-user","default-config"],"who_is_affected":"Deployments running Apache CouchDB 3.5.2 or earlier on any platform where more than one authenticated user can create or view replications. Single-user installations where only trusted operators create replications carry little practical exposure. Installations already on 3.5.3 or later are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000609,"input_tokens":3322,"output_tokens":554,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-107755':12A,15A '-2026':11A,14A '3.5.2':26B,80C '3.5.3':109C 'allow':86C 'apach':1A,24B,78C 'attack':51B 'authent':39B,88C 'couchdb':2A,16B,25B,79C 'credenti':9A,32B,45B,72C,93C 'cve':10A,13A 'databas':4A,36B,68B,76C 'filter':31B,70C 'fix':111C 'get':52B 'host':23B 'insuffici':69C 'issu':113C 'job':63B 'leak':5A 'multi':18B 'multi-us':17B 'packag':20B 'password':57B 'platform':85C 'reach':66B 'read':42B,91C 'recommend':104C 'replic':3A,8A,35B,44B,49B,62B,75C,92C,97C 'self':22B 'self-host':21B 'store':54B 'upgrad':106C 'use':58B 'user':7A,19B,40B,48B,61B,89C,96C,102C 'usernam':55B 'version':108C","nicknames":[],"mitigations":[],"who_affected":"Deployments running Apache CouchDB 3.5.2 or earlier on any platform where more than one authenticated user can create or view replications. Single-user installations where only trusted operators create replications carry little practical exposure. Installations already on 3.5.3 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T16:16:59+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:M/U:Amber","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107755","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107755","severity":null,"published_at":"2026-10-20T16:16:59+00:00","modified_at":"2026-10-20T19:34:00+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}