An issue was discovered in Couchbase Server 6.5.x and 6.6.x before 6.6.6, 7.x before 7.0.5, and 7.1.x before 7.1.2.

published 2023-02-06 3 y ago modified 2026-06-17 4 mo ago also EUVD-2022-46006

cvss: 8.1; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.7%; EPSS 0.7% chance of exploitation in 30 days, percentile 51%
public exploits: 0; none known

An issue was discovered in Couchbase Server 6.5.x and 6.6.x before 6.6.6, 7.x before 7.0.5, and 7.1.x before 7.1.2. During the start-up of a Couchbase Server node, there is a small window of time (before the cluster management authentication has started) where an attacker can connect to the cluster manager using default credentials.

Patch / fix

fixed in 1

couchbase couchbase_server 6.6.6, 7.0.5, 7.1.2

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 19 mo ago (2025-03-26)

Exploit prediction

0.66% chance of exploitation in the next 30 days, higher than 51% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	8.1	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	3.1	8.1	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA	3.1	8.1	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

Weakness

CWE-287 Improper Authentication
CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization

References

couchbase.com /alerts/
vendor-advisory
forums.couchbase.com /tags/security
issue-tracking
docs.couchbase.com /server/current/release-notes/relnotes.html
release-notes

Sources

CVE List CVE-2022-42951
NVD CVE-2022-42951

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary