EUVD-2026-105101
GHSA-5433-3876-mmp4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege user
-
ExploitQuery _replicator database
-
ImpactRead other users' replication credentials
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated CouchDB account (PR:L) AND the pre-existing condition (AT:P) that other users have configured replication jobs whose credentials are stored in the shared _replicator database - with no such victim replications present, there is nothing to disclose. The attacker needs no user interaction and no elevated/admin privileges, but the flaw only yields value in multi-user or multi-tenant deployments where distinct users' replication credentials coexist. Single-user or single-tenant installations, and deployments that do not store credential-bearing replications, are not meaningfully exposed. Limited to Apache CouchDB versions 3.5.2 and below. |
| Impact | This is a moderate-severity information disclosure flaw (vendor CVSS 4.0 base 6.0) that is a real but not urgent priority. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N) shows network reachability with low complexity but requires an authenticated account (PR:L) and carries an explicit attack requirement (AT:P) - namely that other users' credential-bearing replications already exist in the _replicator database. Exploit maturity is E:U (no public exploit identified), there is no CISA KEV listing and no POC was supplied, so this is not actively exploited. Note a tension in the vendor vector: it claims VC:H/VI:H and SC:H/SI:H, but the description is purely a read/disclosure of stored replication credentials - the direct integrity impact (VI:H/SI:H) is not substantiated by the description and likely reflects the downstream value of the leaked credentials rather than a direct write primitive; treat the integrity rating as inferred, not confirmed. No EPSS score was provided to gauge exploitation probability. Net assessment: a credentialed-insider / multi-tenant confidentiality risk worth patching on a normal cycle, not an emergency. |
| Exploit ScenarioDerived | An authenticated low-privilege user on a shared or multi-tenant CouchDB 3.5.2-or-earlier cluster queries the _replicator database and recovers the stored replication credentials (e.g. remote database usernames/passwords or tokens) belonging to other users' replication jobs. No public exploit code is known, and because exploitation hinges on other users having configured credential-bearing replications, the scenario is most realistic in shared hosting or multi-team deployments. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 20, 2026
Insufficient filtering in Apache CouchDB's shared _replicator database (3.5.2 and earlier, all platforms) allows any authenticated user to read the replication credentials belonging to other users' replication jobs, potentially exposing usernames, passwords, or auth tokens for external source and target endpoints. The flaw is only meaningful in multi-user or multi-tenant deployments where distinct users' credential-bearing replications coexist; a low-privileged account with no user interaction and no admin rights can harvest those secrets and pivot to the systems they unlock, which is why the vendor's CVSS 4.0 vector rates subsequent-system confidentiality as high. Upgrading to 3.5.3 fixes the issue; no public exploit code or confirmed active exploitation was identified at time of analysis.
RemediationAI
Upgrade to Apache CouchDB 3.5.3, which contains the fix, following the vendor advisory at https://lists.apache.org/thread/ro57p4r2lhxn2n4712ppx7r11oqq900n - Vendor-released patch: 3.5.3. Because credentials may already have been readable, treat any secrets stored in _replicator documents as potentially compromised: audit those documents for inline userinfo or auth headers and rotate the corresponding passwords/tokens at the remote endpoints. Where immediate upgrade is not possible, tighten the _replicator database's security object so only a trusted administrative role can read it (trade-off: ordinary users lose visibility into their own replication status and must go through an operator), isolate tenants onto separate CouchDB instances or ports so credential stores never mingle (trade-off: higher operational overhead), and move away from embedding long-lived credentials in replication URLs toward short-lived tokens or proxy-mediated replication (trade-off: requires client and configuration changes). Monitoring for unexpected reads of _replicator documents by low-privileged accounts provides detection coverage in the interim.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache CouchDB is a document-oriented JSON database whose _replicator database holds one document per configured replication job; these documents routinely embed source and target endpoint URLs containing inline userinfo (user:password@host) or authorization headers so the replicator daemon can authenticate to remote CouchDB instances. Because _replicator is a shared database, read access to it is governed by database security objects and per-document filtering, and the defect is that credential-bearing fields are not stripped for viewers who do not own the replication - an exposure-of-sensitive-information / improper-authorization class issue (the vendor assigned no CWE, but it maps to CWE-200/CWE-285 style weaknesses). The CVSS 4.0 vector's AT:P reflects that exploitation depends on a pre-existing condition - other users must have stored credential-bearing replications - and SC:H captures the downstream confidentiality impact on the external systems those credentials unlock; our independent CVSS 3.1 assessment (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) scopes the impact to the disclosure itself, since the flaw grants no write or availability impact on CouchDB.
Know when Apache Couchdb gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:U/S:N/AU:Y/R:U/V:C/RE:M/U:Amber
Authenticated network read of stored credentials gives PR:L and C:H; the described vulnerability is pure disclosure, so I:N/A:N and scope unchanged within CouchDB's auth context.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
4DescriptionCVE.org
Insufficient filtering of credentials in the _replicator database in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to read replication credentials of other users’ replications, not just their own.
Users are recommended to upgrade to version 3.5.3, which fixes this issue.
Executive ViewAI
Apache CouchDB deployments at version 3.5.2 and earlier expose replication credentials between tenants: any account holder on a shared instance can read the endpoint usernames, passwords, and auth tokens that belong to other users' replication jobs. The exposure matters most for shared or multi-tenant CouchDB environments, where harvested credentials can be reused to reach external source and target systems outside the database itself, turning a single low-privilege account into a foothold across connected infrastructure. Leadership should care because the blast radius extends beyond CouchDB to every third-party system those stored credentials unlock.
Apply vendor patch. Where upgrade to 3.5.3 cannot be completed immediately, isolate multi-tenant instances, restrict _replicator access to a minimal set of trusted administrators, avoid storing long-lived endpoint credentials in shared replication documents, segment outbound network access from CouchDB to external endpoints, and rotate all replication credentials.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Apache Couchdb
View allArbitrary shell command execution in Apache CouchDB 3.5.2 and earlier on all platforms allows an authenticated CouchDB s
Unauthenticated read access to the complete contents of prefixed system databases is possible in Apache CouchDB 3.5.2 an
Memory-exhaustion denial of service in Apache CouchDB 3.5.2 and earlier allows any unauthenticated remote client to cras
Authenticated users can exhaust memory in Apache CouchDB 3.5.2 and earlier through unsafe binary deserialization in the
Denial of service in Apache CouchDB 3.5.2 and earlier: the replicator lacks a circuit-breaker on HTTP redirects, so a re
Exploit-DB