Sync Gateway vulnerabilities

2 known vulnerabilities in Sync Gateway from Couchbase. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.3 High severity

  Sync Gateway: Cleartext Transmission of Sensitive Information

  CVE-2025-52490Jul 29, 2025Couchbase

  An issue was discovered in Couchbase Sync Gateway before 3.2.6. In sgcollect_info_options.log and sync_gateway.log, there are cleartext passwords in redacted and unredacted output.

• 9.8 Critical severity

  Sync Gateway: Improper Certificate Validation

  CVE-2022-32563Jun 10, 2022Couchbase

  An issue was discovered in Couchbase Sync Gateway 3.x before 3.0.2. Admin credentials are not verified when using X.509 client-certificate authentication from Sync Gateway to Couchbase Server. When Sync Gateway is configured to authenticate with Couchbase Serv