CVE-2020-24719

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 23.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-11-12 · updated 2026-06-17
Weakness: CWE-78

Description

Exposed Erlang Cookie could lead to Remote Command Execution (RCE) attack. Communication between Erlang nodes is done by exchanging a shared secret (aka "magic cookie"). There are cases where the magic cookie is included in the content of the logs. An attacker can use the cookie to attach to an Erlang node and run OS level commands on the system running the Erlang node. Affects version: 6.5.1. Fix version: 6.6.0.

Affected products

Couchbase Server: from 6.5.1 before 6.6.0 — fixed in 6.6.0

How to fix

Upgrade to a fixed version: Couchbase Server 6.6.0. Check the vendor advisory for mitigations.

References

https://www.couchbase.com/resources/security#VulnerabilityReporting
https://www.couchbase.com/resources/security#VulnerabilityReporting

Get alerted when CVE-2020-24719 or the next vulnerability affects your stack