An issue was discovered in Couchbase Sync Gateway 3.x before 3.0.2. Admin credentials are not verified when using X.509 client-certificate authentication from Sync Gateway to Couchbase Server. When Sy
An issue was discovered in Couchbase Sync Gateway 3.x before 3.0.2. Admin credentials are not verified when using X.509 client-certificate authentication from Sync Gateway to Couchbase Server. When Sync Gateway is configured to authenticate with Couchbase Server using X.509 client certificates, the admin credentials provided to the Admin REST API are ignored, resulting in privilege escalation for unauthenticated users. The Public REST API is not impacted by this issue. A workaround is to replace X.509 certificate based authentication with Username and Password authentication inside the bootstrap configuration.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | couchbase | >= 3.0.0, < 3.0.2 | 3.0.2 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2022-32563
- https://forums.couchbase.com/tags/security
- https://github.com/pypa/advisory-database/tree/main/vulns/couchbase/PYSEC-2022-207.yaml
- https://www.couchbase.com/alerts
- https://www.couchbase.com/alerts/#CVE-2022-32563
- https://github.com/advisories/GHSA-9266-j9v3-q4j5
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Weakness (CWE)
CWE-295- Platform
- Python (PyPI)
- Package
couchbase- Disclosed
- 10.06.2022
- Updated
- 11.10.2026 12:19
Sources and licenses
OSV / GitHub Advisory Database - GHSA-9266-j9v3-q4j5 - CC BY 4.0
OSV / GitHub Advisory Database - PYSEC-2022-207 - PyPA Advisory Database; CC BY 4.0
Vulnerability history: couchbase
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 3
- First → latest
- 06.2022 07.2025
- Without a fix
- 1
- Exploited in attacks
- 0
Severity breakdown
- Critical 1
- High 2
Disclosures per year
- 2022: 1
- 2023: 1
- 2024: 0
- 2025: 1
- 2026: 0
-
An issue was discovered in Couchbase Sync Gateway 3.x before 3.0.2. Admin credentials are not verified when using X.509 client-certificate authentication from Sync Gateway to Couchbase Server. When Sy this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.