CVE-2021-25645

An issue was discovered in Couchbase Server before 6.0.5, 6.1.x through 6.5.x before 6.5.2, and 6.6.x before 6.6.1. An internal user with administrator privileges, @ns_server, leaks credentials in cleartext in the cbcollect_info.log, debug.log, ns_couchdb.log, indexer.log, and stats.log files. NOTE: updating the product does not automatically address leaks that occurred in the past.

• CWE-312

• https://www.couchbase.com/downloadsProduct, Vendor Advisory
• https://www.couchbase.com/resources/security#SecurityAlertsVendor Advisory
• https://www.couchbase.com/downloadsProduct, Vendor Advisory
• https://www.couchbase.com/resources/security#SecurityAlertsVendor Advisory

Published

May 10, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-25636LibreOffice supports digital signatures of ODF documents and…7.5
• CVE-2021-25640In Apache Dubbo prior to 2.6.9 and 2.7.9, the usage of parse…6.1
• CVE-2021-25641Each Apache Dubbo server will set a serialization id to tell…9.8
• CVE-2021-25642ZKConfigurationStore which is optionally used by CapacitySch…8.8
• CVE-2021-25643An issue was discovered in Couchbase Server 5.x and 6.x befo…4.9
• CVE-2021-25644An issue was discovered in Couchbase Server 5.x and 6.x thro…7.5
• CVE-2021-25646Apache Druid includes the ability to execute user-provided J…8.8
• CVE-2021-25647Mobile application "Testes de Codigo" v11.3 and prior allows…5.4
• CVE-2021-25648Mobile application "Testes de Codigo" 11.4 and prior allows …9.8
• CVE-2021-25649An information disclosure vulnerability was discovered in th…5.5
• CVE-2021-25650A privilege escalation vulnerability was discovered in Avaya…8.8
• CVE-2021-25651A privilege escalation vulnerability was discovered in Avaya…7.8