CVE-2021-25643

—

CVSS 3.1

4.9 medium

EPSS

<1%p41

Published

May 26, 2021 (May 26, 2021)

Modified

Jun 17, 2026

Description

An issue was discovered in Couchbase Server 5.x and 6.x before 6.5.2 and 6.6.x before 6.6.2. Internal users with administrator privileges, @cbq-engine-cbauth and @index-cbauth, leak credentials in cleartext in the indexer.log file when they make a /listCreateTokens, /listRebalanceTokens, or /listMetadataTokens call.

Vendors: couchbase
Products: couchbase server
Weakness: CWE-319
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.5%)

In the news0 stories

No ingested article mentions this CVE yet.