BIT-couchdb-2026-107755: Apache CouchDB: Credential Disclosure to Non-Owner Members via Object-Form Replication Endpoint URLs

Q: Who can access the exposed replication credentials?

Any authenticated user can read replication credentials associated with other users’ replications in the _replicator database. The issue is not limited to the owner of a replication.

Q: What versions are affected and what is the fix?

Apache CouchDB 3.5.2 and earlier are affected on all platforms. Upgrade to version 3.5.3, which fixes the insufficient credential filtering.

Q: Does exploitation require authentication or user interaction?

An attacker needs to be authenticated to exploit the issue. No user interaction is required.

Published Oct 29, 2026

Updated

Insufficient filtering of credentials in the replicator database in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to read replication credentials of other users’ replications, not just their own.

Users are recommended to upgrade to version 3.5.3, which fixes this issue.

Affected Software

1 affected componentFixes available

bitnami/couchdb<3.5.3

3.5.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade bitnami/couchdb to a version that resolves this vulnerability.
Fixed in 3.5.3
Upgrade
Upgrade Apache CouchDB to a version that resolves this vulnerability.
Fixed in 3.5.3

Event History

Oct 29, 2026

Advisory Published

via OSV·08:39 AM

Data Sourced

via OSV·08:39 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who can access the exposed replication credentials?

Any authenticated user can read replication credentials associated with other users’ replications in the _replicator database. The issue is not limited to the owner of a replication.

What versions are affected and what is the fix?

Apache CouchDB 3.5.2 and earlier are affected on all platforms. Upgrade to version 3.5.3, which fixes the insufficient credential filtering.

Does exploitation require authentication or user interaction?

An attacker needs to be authenticated to exploit the issue. No user interaction is required.

BIT-couchdb-2026-107755: Apache CouchDB: Credential Disclosure to Non-Owner Members via Object-Form Replication Endpoint URLs

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can access the exposed replication credentials?

What versions are affected and what is the fix?

Does exploitation require authentication or user interaction?

Company

Resources

Contact

Frequently Asked Questions

Who can access the exposed replication credentials?

What versions are affected and what is the fix?

Does exploitation require authentication or user interaction?