---
id: "CVE-2026-107755"
kind: "vulnerability"
aliases: ["CVE-2026-107755"]
title: "Apache CouchDB: replicator database leaks other users' replication credentials"
severity: "medium"
cvss: 6.0
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["couchdb", "multi-user", "package", "self-hosted"]
not_affected_if: ["default-config", "single-user"]
published_at: "2026-10-20T16:16:59+00:00"
first_seen_at: "2026-10-23T21:57:20+00:00"
updated_at: "2026-10-25T04:05:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107755", "first_seen_at": "2026-10-23T21:57:20+00:00"}]
---

# Apache CouchDB: replicator database leaks other users' replication credentials

Apache CouchDB 3.5.2 and below does not filter credentials in the _replicator database, so an authenticated user can read the replication credentials of other users' replications. An attacker gets the stored usernames and passwords used by other users' replication jobs, which can reach other databases.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed CouchDB version with `curl -s http://localhost:5984/` and look at the "version" field
- Confirm whether multiple users create replications by listing `_replicator` docs with `curl -u admin:password http://localhost:5984/_replicator/_all_docs`

## Fix

- Upgrade Apache CouchDB to `3.5.3`, which fixes the issue
- Rotate credentials used in existing replication documents if other users could have read them

## Timeline

- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107755

## From the sources

Insufficient filtering of credentials in the _replicator database in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to read replication credentials of other users’ replications, not just their own.

Users are recommended to upgrade to version 3.5.3, which fixes this issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_