Advisoriesby IbisCouchbase Sync GatewayGHSA-pqhp-4xfc-hjgq
Couchbase Sync Gateway shows cleartext passwords in redacted and unredacted output
Fix: upgrade to 3.2.6 or later
An issue was discovered in Couchbase Sync Gateway before 3.2.6. In sgcollect_info_options.log and sync_gateway.log, there are cleartext passwords in redacted and unredacted output.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/couchbase/sync_gateway Go | < 3.2.6 | 3.2.6 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-319
- Also known as
- CVE-2025-52490, GO-2026-5550, PYSEC-2025-101