CVE-2021-25644: Couchbase Server

High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days.

An issue was discovered in Couchbase Server 5.x and 6.x through 6.6.1 and 7.0.0 Beta. Incorrect commands to the REST API can result in leaked authentication information being stored in cleartext in the debug.log and info.log files, and is also shown in the UI visible to administrators.

Affected products

• Couchbase Couchbase Server: from 5.0.0, up to and including 6.6.1; version 7.0.0 only

Published 2021-05-19. Last modified 2026-06-17.