CVE-2021-25645: Couchbase Server

Medium severity, CVSS 4.4. EPSS: 0.2% chance of exploitation in the next 30 days.

An issue was discovered in Couchbase Server before 6.0.5, 6.1.x through 6.5.x before 6.5.2, and 6.6.x before 6.6.1. An internal user with administrator privileges, @ns_server, leaks credentials in cleartext in the cbcollect_info.log, debug.log, ns_couchdb.log, indexer.log, and stats.log files. NOTE: updating the product does not automatically address leaks that occurred in the past.

Affected products

• Couchbase Couchbase Server: before 6.0.5 (fixed in 6.0.5); from 6.1.0, before 6.5.2 (fixed in 6.5.2); from 6.6.0, before 6.6.1 (fixed in 6.6.1)

Published 2021-05-10. Last modified 2026-06-17.