CVE-2026-107755: Apache CouchDB: Credential Disclosure to Non-Owner Members via Object-Form Replication Endpoint URLs
Insufficient filtering of credentials in the replicator database in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to read replication credentials of other users’ replications, not just their own.
Users are recommended to upgrade to version 3.5.3, which fixes this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache CouchDBto a version that resolves this vulnerability.Fixed in 3.5.3
Event History
Frequently Asked Questions
Who can access the exposed replication credentials?
Any authenticated Apache CouchDB user can read credentials associated with other users' replications in the _replicator database. The issue is not limited to replication owners.
What configurations are affected?
The issue affects Apache CouchDB 3.5.2 and earlier on all platforms when replication endpoint URLs are supplied in object form and credentials are stored in the _replicator database.
What is the remediation?
Upgrade Apache CouchDB to version 3.5.3, which fixes the insufficient credential filtering.