N1QLMap

Description N1QLMap is an N1QL exploitation tool. Currently works with Couchbase database. The tool supports data extraction and performing SSRF attacks via CURL. More information can be found here: https://labs.f-secure.com/blog/n1ql-injection-kind-of-sql-injection-in-a-nosql-database. Usage Hel...

CVE-2026-46587

camel-couchbase CCB Header Injection Reproducer CVE-2026-46587 This project demonstrates a message-header injection in Apache Camel's camel-couchbase component, tracked as CVE-2026-46587. The component reads several Exchange headers to control its behaviour — CCBKEY document key, CCBID document i...

Couchbase Server - Broken Access Control

Couchbase Server versions 4.0.0, 4.1.0, 4.1.1, 4.5.0, 4.5.1, 4.6.0-4.6.5, 5.0.0, 5.1.1, 5.5.0, and 5.5.1 contain insecure permissions for the projector and indexer REST endpoints caused by unauthenticated access, letting attackers access administrative APIs without authentication, exploit require...

SUSE CVE-2025-52490

An issue was discovered in Couchbase Sync Gateway before 3.2.6. In sgcollectinfooptions.log and syncgateway.log, there are cleartext passwords in redacted and unredacted output...

Couchbase Server - Broken Access Control Detection

Couchbase Server versions 4.0.0, 4.1.0, 4.1.1, 4.5.0, 4.5.1, 4.6.0-4.6.5, 5.0.0, 5.1.1, 5.5.0, and 5.5.1 contain insecure permissions for the projector and indexer REST endpoints caused by unauthenticated access, letting attackers access administrative APIs without authentication, exploit require...

CouchbaseProducer Component Data Access

The vulnerability of the CouchbaseProducer class in the camel-couchbase component of the Apache Camel framework is related to insufficient validation of input data. Exploiting this vulnerability may allow an attacker to gain read, modify, or delete access to data...

CouchDbProducer Camel Framework Data Access

The vulnerability of the CouchDbProducer class in the camel-couchbase framework of the Apache Camel framework is related to insufficient validation of input data. Exploiting this vulnerability may allow an attacker to gain read, modify, or delete access to data...

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Overview Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes via the handling of Exchange headers that are not prefixed with 'Camel', which bypass the HeaderFilterStrategy process. An attacker can override operations b...

org.apache.camel.kafkaconnector:camel-couchbase-sink-kafka-connector (4.18.0), org.apache.camel.kafkaconnector:itests-couchbase (4.18.0) +4 more potentially affected by CVE-2026-46587 via org.apache.camel:camel-couchbase (>=4.15.0, <=4.18.2)

org.apache.camel:camel-couchbase MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =4.15.0, =4.18.2 Source cves: CVE-2026-46587 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17822328...

org.apache.camel.kafkaconnector:camel-couchbase-sink-kafka-connector (4.18.0), org.apache.camel.kafkaconnector:itests-couchbase (4.18.0) +4 more potentially affected by CVE-2026-46587 via org.apache.camel:camel-couchbase (>=4.15.0, <=4.18.2)

org.apache.camel:camel-couchbase MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =4.15.0, =4.18.2 Source cves: CVE-2026-46587 Source advisory: GHSA-46JF-C9VX-HH79...

GHSA-46JF-C9VX-HH79 Apache Camel-Couchbase: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operation override from untrusted input

Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: through 4.14.7, from 4.15.0 through 4.18.2, from 4.19.0 through 4.20.0. Users are recommended to upgrade to version 4.14.8, 4.18.3, 4.21.0, which fixes the issue...

org.apache.camel.quarkus:camel-quarkus-couchbase (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-couchbase-deployment (>=3.35.0, <=3.36.0) +1 more potentially affected by CVE-2026-46587 via org.apache.camel:camel-couchbase (>=4.19.0, <=4.20.0)

org.apache.camel:camel-couchbase MAVEN version =4.19.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-46587 Source advisory: OSV:GHSA-46JF-C9VX-HH79...

org.apache.camel.quarkus:camel-quarkus-couchbase (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-couchbase-deployment (>=3.35.0, <=3.36.0) +1 more potentially affected by CVE-2026-46587 via org.apache.camel:camel-couchbase (>=4.19.0, <=4.20.0)

org.apache.camel:camel-couchbase MAVEN version =4.19.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-46587 Source advisory: GHSA-46JF-C9VX-HH79...

CVE-2026-46587 Apache Camel: Couchbase: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operation override from untrusted input

Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: through 4.14.7, from 4.15.0 through 4.18.2, from 4.19.0 through 4.20.0. Users are recommended to upgrade to version 4.14.8, 4.18.3, 4.21.0, which fixes the issue...

CVE-2026-46587

Apache Camel is vulnerable to an improper input validation flaw in the camel-couchbase component, specifically affecting the CouchbaseProducer class. The root cause is that certain Exchange headers (e.g., CCB_KEY, CCB_ID, CCB_TTL, CCB_DDN, and CCB_VN) use plain names without the standard Camel pr...

CVE-2026-46587 Apache Camel: Couchbase: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operation override from untrusted input

Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: through 4.14.7, from 4.15.0 through 4.18.2, from 4.19.0 through 4.20.0. Users are recommended to upgrade to version 4.14.8, 4.18.3, 4.21.0, which fixes the issue...

CVE-2026-46587 Apache Camel: Couchbase: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operation override from untrusted input

Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: through 4.14.7, from 4.15.0 through 4.18.2, from 4.19.0 through 4.20.0. Users are recommended to upgrade to version 4.14.8, 4.18.3, 4.21.0, which fixes the issue...

org.apache.camel.kafkaconnector:camel-couchbase-sink-kafka-connector (4.18.0), org.apache.camel.kafkaconnector:itests-couchbase (4.18.0) +4 more potentially affected by CVE-2026-46587 via org.apache.camel:camel-couchbase (>=4.15.0, <=4.18.2)

org.apache.camel:camel-couchbase MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =4.15.0, =4.18.2 Source cves: CVE-2026-46587 Source advisory: MEND:CVE-2026-46587...

PYSEC-2026-1053 Openstack DBaaS (Trove) Improper Link Resolution Before File Access

The writeconfig function in trove/guestagent/datastore/experimental/mongodb/service.py, resetconfiguration function in trove/guestagent/datastore/experimental/postgresql/service/config.py, writeconfig function in trove/guestagent/datastore/experimental/redis/service.py, writemycnf function in...

GO-2026-5550 Couchbase Sync Gateway shows cleartext passwords in redacted and unredacted output in github.com/couchbase/sync_gateway

Couchbase Sync Gateway shows cleartext passwords in redacted and unredacted output in github.com/couchbase/syncgateway. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...