2.23. CVE-2026-107755: Credential Disclosure via Object-Form Replication URLs in _replicator

Date:

12.10.2026

Affected:

3.5.2 and below

Severity:

High

Vendor:

The Apache Software Foundation

2.23.1. Description

The CouchDB /_replicator database (and prefixed variants) allow specification of source and target credentials in two forms: as a URL string and as a URL object. When non-owner users retrieve a replication documents, CouchDB obfuscates credentials only in the URL string case. URL objects will show non- owners the credentials.

2.23.2. Mitigation

URL objects in replication docs are now correctly obfuscating credentials for non-owners.

2.23.3. Workarounds

N/A

2.23.4. Credit

Sakil Ahamed Gayen