Is CVE-2025-52490 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-52490 being exploited in the wild.

How severe is CVE-2025-52490?

High severity, with a CVSS score of 7.3, published 29 July 2025.

Which products and versions are affected?

Couchbase Sync Gateway < 3.2.6; github.com/couchbase/sync_gateway (Go) < 3.2.6, SEMVER:introduced=0, SEMVER:introduced=0,fixed=3.2.6; couchbase (PyPI) ECOSYSTEM:introduced=0,fixed=3.2.6.

Is there a fix for CVE-2025-52490?

Yes. github.com/couchbase/sync_gateway (Go): upgrade to 3.2.6 or later; couchbase (PyPI): upgrade to 3.2.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-52490 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-52490?

Check whether you run Couchbase Sync Gateway, github.com/couchbase/sync_gateway (Go) or couchbase (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-52490: Couchbase Sync Gateway cleartext password disclosure in logs

Q: Is there a fix for CVE-2025-52490?

Yes. github.com/couchbase/sync_gateway (Go): upgrade to 3.2.6 or later; couchbase (PyPI): upgrade to 3.2.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2025-52490 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2025-52490?

Check whether you run Couchbase Sync Gateway, github.com/couchbase/sync_gateway (Go) or couchbase (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-52490 · Severity: high · CVSS 7.3 · Published 2025-07-29

Couchbase Sync Gateway, a component used to synchronize data between mobile devices and the cloud, was found to be leaking user passwords in plain text within its log files. This occurs even when redaction features are enabled, potentially allowing anyone with access to the logs to see sensitive credentials. This could lead to unauthorized account access and data breaches if log files are improperly secured or shared.

Technologies: couchbase (PyPI). Vendors: Go, PyPI.

Quick answers

Is CVE-2025-52490 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-52490 being exploited in the wild.
How severe is CVE-2025-52490?: High severity, with a CVSS score of 7.3, published 29 July 2025.
Which products and versions are affected?: Couchbase Sync Gateway < 3.2.6; github.com/couchbase/sync_gateway (Go) < 3.2.6, SEMVER:introduced=0, SEMVER:introduced=0,fixed=3.2.6; couchbase (PyPI) ECOSYSTEM:introduced=0,fixed=3.2.6.
Is there a fix for CVE-2025-52490?: Yes. github.com/couchbase/sync_gateway (Go): upgrade to 3.2.6 or later; couchbase (PyPI): upgrade to 3.2.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-52490 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-52490?: Check whether you run Couchbase Sync Gateway, github.com/couchbase/sync_gateway (Go) or couchbase (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/couchbase/sync_gateway (Go): upgrade to 3.2.6 or later
```
go get github.com/couchbase/sync_gateway@v3.2.6
```
couchbase (PyPI): upgrade to 3.2.6 or later
```
pip install "couchbase>=3.2.6"
```

Technical details

Couchbase Sync Gateway prior to version 3.2.6 contains a sensitive information disclosure vulnerability (CWE-319). The application logs cleartext passwords in 'sgcollect_info_options.log' and 'sync_gateway.log', even when log redaction is enabled. An attacker with access to these log files—or potentially via network-based log collection services—could obtain administrative or user credentials. This issue is resolved in version 3.2.6. The CVSS score of 7.3 reflects a network attack vector, though exploitation typically requires the ability to view or intercept log output.

Affected products

Couchbase Sync Gateway < 3.2.6

Identifiers

CVE-2025-52490
GHSA-pqhp-4xfc-hjgq
GO-2026-5550
PYSEC-2025-101

Timeline

2025-07-29: disclosed
2025-07-29: advisory
2025-07-29: patched: Version 3.2.6 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.