CVE-2025-59792CWE-312

CVE-2025-59792

Medium · published November 28, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
21.1
In the wild
Unconfirmed
What it is

Reveals plaintext credentials in the MONITOR command vulnerability in Apache Kvrocks.

This issue affects Apache Kvrocks: from 1.0.0 through 2.13.0.

Users are recommended to upgrade to version 2.14.0, which fixes the issue.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00296 · 21.1th percentile
Weakness
CWE-312 · Cleartext Storage of Sensitive Information
Published
2025-11-28T20:16Z
Affected products (1)
ProductVersionsFixed in
apache/kvrocks≥ 1.0.0, < 2.14.02.14.0
References (2)
https://lists.apache.org/thread/h2pcvr5p9otc7dnj2dt2nr4b3omghddw · [email protected]http://www.openwall.com/lists/oss-security/2025/11/28/3 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 28 NOV 14:21Z
    Apache Kvrocks: MONITOR command reveals plaintext credentials to non-admins
    cvelistv5