Couchbase Sync Gateway shows cleartext passwords in redacted and unredacted output

HIGH 7.3CVE-2025-52490 · GHSA-pqhp-4xfc-hjgq · GO-2026-5550 · Published 29/07/2025 · updated 17/06/2026

Package	Affected versions	Patched versions
github.com/couchbase/sync_gateway Go	`< 3.2.6all versions`	`3.2.6`
couchbase PyPI	`< 3.2.6`	`3.2.6`
sync gateway couchbase	`< 3.2.6`	`3.2.6`

Description

An issue was discovered in Couchbase Sync Gateway before 3.2.6. In sgcollect_info_options.log and sync_gateway.log, there are cleartext passwords in redacted and unredacted output.

NVD description

An issue was discovered in Couchbase Sync Gateway before 3.2.6. In sgcollect_info_options.log and sync_gateway.log, there are cleartext passwords in redacted and unredacted output.

References

nvd.nist.gov/vuln/detail/CVE-2025-52490 · ADVISORY
docs.couchbase.com/server/current/release-notes/relnotes.html · WEB
forums.couchbase.com/tags/security · WEB
couchbase/sync_gateway · PACKAGE
couchbase.com/alerts · WEB
couchbase.com/alerts · Vendor Advisory
GitHub Advisory GHSA-pqhp-4xfc-hjgq · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free