Loading vulnerability…
Replication Credential Disclosure in Apache CouchDB
CVE-2026-107755 is a credential-disclosure vulnerability affecting Apache CouchDB 3.5.2 and earlier on all platforms. Insufficient credential filtering in the _replicator database exposes credentials in object-form replication endpoint URLs to authenticated non-owner members. Affected users can read credentials belonging to other users’ replications rather than only their own. Apache CouchDB 3.5.3 fixes the issue.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An authenticated user can obtain other users’ replication credentials, compromising credential confidentiality and potentially enabling unauthorized access to replication endpoints and resources accessible with those credentials. Further data access or modification depends on the permissions granted to the exposed credentials.
Patch, then assume compromise.
Upgrade Apache CouchDB to version 3.5.3, which corrects the credential-filtering vulnerability.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.