CVE-2021-42763

7.5 HIGH

Couchbase Server before 6.6.3 and 7.x before 7.0.2 stores Sensitive Information in Cleartext

Published: 2021-11-02 · Last updated: 2026-06-17

Severity and scoring

CVSS: 7.5 HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE: CWE-312

Affected products

Vendor	Product
couchbase	couchbase_server

Description

Couchbase Server before 6.6.3 and 7.x before 7.0.2 stores Sensitive Information in Cleartext. The issue occurs when the cluster manager forwards a HTTP request from the pluggable UI (query workbench etc) to the specific service. In the backtrace, the Basic Auth Header included in the HTTP request, has the "@" user credentials of the node processing the UI request.

Source: NVD

References

[NVD]https://nvd.nist.gov/vuln/detail/CVE-2021-42763
[Vendor advisory]https://docs.couchbase.com/server/current/release-notes/relnotes.html
[Vendor advisory]https://www.couchbase.com/alerts
[Vendor advisory]https://docs.couchbase.com/server/current/release-notes/relnotes.html
[Vendor advisory]https://www.couchbase.com/alerts

Related CVEs

Same CWE

CVE-2026-46622 — SolidInvoice is an open-source invoicing platform (8.1 HIGH)
CVE-2026-10786 — Improper access control in the ticketing integration settings in Devolutions Server allows an authenticated low-privileged user to obtain... (6.5 MEDIUM)
CVE-2026-36176 — GNCC GP5 v7.1.76 was discovered to store pre-signed Backblaze B2 upload URLs (PUT requests) in plaintext to the serial console (7.1 HIGH)
CVE-2026-4387 — StrongDM Desktop Application before 23.74.0 (Desktop Client before 53.77.0) on Microsoft Windows stores authentication state, including a...
CVE-2026-45040 — RustFS is a distributed object storage system built in Rust