Medium severity · published Oct 20, 2026
CVE-2026-107755
Apache CouchDB: Credential Disclosure to Non-Owner Members via Object-Form Replication Endpoint URLs
6.0
CVSS
0.6%
EPSS
No
On KEV
Description
Insufficient filtering of credentials in the _replicator database in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to read replication credentials of other users’ replications, not just their own.
Users are recommended to upgrade to version 3.5.3, which fixes this issue.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 48% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
Apache CouchDB · Apache Software Foundation
before 3.5.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-107755
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-107755
lists.apache.org
https://lists.apache.org/thread.html/pj83174r8f8f64odf47fwhozbfjtot0f
lists.apache.org
https://lists.apache.org/thread/ro57p4r2lhxn2n4712ppx7r11oqq900n
www.openwall.com
http://www.openwall.com/lists/oss-security/2026/10/20/16
More from Apache CouchDB
9.8
CVE-2022-24706
Remote Code Execution Vulnerability in Packaging
9.3
CVE-2026-86471
Apache CouchDB: Admin credentials leading to code execution as operating system user
8.1
CVE-2026-90800
Apache CouchDB: Auth bypass in prefixed _users and _replicator databases
7.7
CVE-2026-90797
Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_session
7.2
CVE-2018-11769
CouchDB administrative users before 2.2.0 can configure the database server via HTTP(S)