PT-2025-48340 · Apache · Apache Kvrocks

CVE-2025-59792 · Published 2025-11-28 · Updated 2025-12-04

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Kvrocks versions 1.0.0 through 2.13.0

Description The MONITOR command in Apache Kvrocks has a flaw that can expose plaintext credentials. This issue affects versions 1.0.0 through 2.13.0.

Recommendations Upgrade to version 2.14.0 to resolve the issue.

Exploit

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2025-59792

Affected Products

Apache Kvrocks

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59792.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-59792 · Vendor Advisory
• https://lists.apache.org/thread/h2pcvr5p9otc7dnj2dt2nr4b3omghddw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59792 · Security Note
• https://t.me/cveNotify/144244 · Telegram Post
• https://t.me/CVEtracker/38443 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1994431325550375060 · Twitter Post
• http://openwall.com/lists/oss-security/2025/11/28/3 · Note
• https://twitter.com/oss_security/status/1996688403287409094 · Twitter Post
• https://twitter.com/CVEnew/status/1994419150815478106 · Twitter Post