CVE-2023-49930 is a critical severity (CVSS 9.8) access control flaw in Couchbase Server before 7.2.4. Calls to the /diag/eval endpoint are not sufficiently restricted. Upgrade to 7.2.4 or later, keep management ports off untrusted networks, and read Couchbase's alerts page for the exact fixed builds in your release line.
What's affected
The record says Couchbase Server before 7.2.4 is affected. The weakness is CWE-284 (improper access control). The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H: network reachable, no login, high impact on confidentiality, integrity and availability.
The record's references are Couchbase's release notes, alerts page and forum security tag. The release notes page I could fetch covers a later 8.0 line and does not mention this CVE, so I could not confirm patched builds for older release lines such as 7.1 or 6.6 from it. If you run an older line, check the alerts page before assuming it is unaffected.
Fixed version: 7.2.4 or later for the 7.2 line, per the record. Any version below 7.2.4 should be treated as exposed until the vendor says otherwise.
How to check if you're exposed
Find the version of each Couchbase node in the admin console or through the command line on the host.
/opt/couchbase/bin/couchbase-server --version
Next, check which hosts expose the Couchbase management port to untrusted networks. By default the web console and REST API use port 8091 for management. A cluster reachable only from application servers is far less exposed than one open to a wider network. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks the open source packages in a manifest against known CVEs. It only sees what you give it, so it will not find a firmware image or a hosted product on its own. Use it for the code you ship and your asset list for everything else.
What to do now
- Inventory all Couchbase Server nodes and their versions.
- Upgrade to 7.2.4 or later, following Couchbase's rolling upgrade guidance. For older release lines, read the alerts page for the right fix.
- Block the management ports from the internet and from any network that does not need them.
- Review cluster logs and users for activity you cannot explain, and rotate administrator and application credentials after patching exposed clusters.
- Run Couchbase under a dedicated low privilege system account.
Why it matters
The endpoint named in the record, /diag/eval, is a diagnostic function, and the record says calls to it are not sufficiently restricted. A debugging feature that accepts requests without enough access control is the kind of weakness that earns a 9.8: there is no login, and the impact reaches the whole host process.
The lesson is broader than one product. Database management interfaces should never face untrusted networks, and diagnostic routes need the same authentication as the rest of the API. This CVE is not on the CISA KEV list, and the sources I could read report no exploitation.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which Couchbase version fixes it?
The record says before 7.2.4 is affected, so 7.2.4 or later. Check the vendor alerts page for older lines.
Does it need credentials?
No. The vector shows no privileges and no user interaction.
Sources
Last reviewed: 19 October 2026.
