PT-2025-48340 · Apache · Apache Kvrocks

Published 2025-11-28 · Updated 2025-12-04 · CVE-2025-59792

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Kvrocks versions 1.0.0 through 2.13.0

Description The MONITOR command in Apache Kvrocks has a flaw that can expose plaintext credentials. This issue affects versions 1.0.0 through 2.13.0.

Recommendations Upgrade to version 2.14.0 to resolve the issue.

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2025-59792

Affected Products

Apache Kvrocks

References · 9

• https://osv.dev/vulnerability/CVE-2025-59792 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59792 · Security Note
• https://lists.apache.org/thread/h2pcvr5p9otc7dnj2dt2nr4b3omghddw · Vendor Advisory
• https://t.me/cveNotify/144244 · Telegram Post
• https://twitter.com/oss_security/status/1996688403287409094 · Twitter Post
• http://openwall.com/lists/oss-security/2025/11/28/3 · Note
• https://twitter.com/CVEnew/status/1994419150815478106 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1994431325550375060 · Twitter Post
• https://t.me/CVEtracker/38443 · Telegram Post