CVE-2025-59792
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
A vulnerability in Apache Kvrocks reveals plaintext credentials in the MONITOR command. This issue affects Apache Kvrocks from 1.0.0 through 2.13.0.
Risk Assessment
An attacker with access to the MONITOR command can capture plaintext credentials, potentially leading to unauthorized access to the system. This may result in data confidentiality breaches and further attacks.
Recommendation
Upgrade Apache Kvrocks to version 2.14.0, which fixes the issue. Restrict access to the MONITOR command to trusted users only.
Other vulnerabilities in Apache Kvrocks
See all- CVE-2026-46752Critical
Vulnerability in the cjson library in Apache Kvrocks causing Lua HEAP overflow. Affects versions from 2.0.4 to 2.15.0.
- CVE-2026-41566Critical
CVE-2026-41566 involves improper handling of insufficient permissions in Apache Kvrocks version 2.8.0. This issue has been fixed in version 2.16.0.
- CVE-2026-54226Medium
A vulnerability in Apache Kvrocks affects versions from 2.6.0 through 2.15.0, and users are recommended to upgrade to version 2.16.0 to fix the issue.
- CVE-2026-46751Medium
A vulnerability in Apache Kvrocks affects versions from 2.2.0 through 2.15.0, and users are recommended to upgrade to version 2.16.0 to fix the issue.
- CVE-2026-45188Low
A Relative Path Traversal vulnerability in Apache Kvrocks may allow attackers to access unauthorized system resources. The issue affects versions from 1.0.0 through 2.15.0.
- CVE-2025-59790Medium
Improper Privilege Management vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks from v2.9.0 through v2.13.0. Users are recommended to upgrade to version 2.14.0, which fixes the issue.
Original NVD description (English source)
Reveals plaintext credentials in the MONITOR command vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from 1.0.0 through 2.13.0. Users are recommended to upgrade to version 2.14.0, which fixes the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS