9,045 internet-reachable Couchbase instances: measuring the document database layer

A total of 9,045 internet-reachable Couchbase instances were identified in a September 2026 analysis, representing a snapshot of the document database layer. Couchbase operates as a distributed database system with multiple services, including a query service, data service, index service, search service, and web console. These services are deployed in clusters and listen on distinct ports. The ZoomEye fingerprint query identified these 9,045 services reachable from the public internet.

Databases play a crucial role in exposure discussions, as the value of the data is typically evident. The numbers presented, such as PostgreSQL at 3,375,720, MariaDB at 5,079,898, and Microsoft SQL Server at 2,070,628, were recorded within the same time frame. However, Couchbase's 9,045 instances represent a distinct product with a unique architecture, necessitating different considerations.

Couchbase's fingerprint query does not involve a port scan but rather identifies services whose responses align with the Couchbase signature. In a multi-service cluster, this could potentially refer to the port that generates the most distinct response rather than the entire deployment. The query measures services matching the ZoomEye application fingerprint for Couchbase, returning a total of 9,045 services.

The Couchbase cluster consists of two primary surfaces: the web console for administrative purposes and the data and query services for the application. The web console enables tasks such as bucket management, user and role configuration, query workbench, and cluster settings. Meanwhile, the data and query services are the actual application components.

In a cluster deployment, these two surfaces are intended to be accessed by different clients. Operators typically use the console, while applications utilize the SDK endpoint.

The exposure question revolves around which of these surfaces is reachable. A public console with authentication requirements serves as an administrative interface, providing insights into cluster configuration, role assignments, and enabling access to data services from within a trusted network. On the other hand, publicly reachable data and query ports present a different challenge, as they accept SDK-level authentication from any originating source.

The authentication history in Couchbase and other NoSQL databases should be taken into account when evaluating exposure.

Comparatively, Couchbase's 9,045 reachable instances are lower than those of relational databases like MySQL, PostgreSQL, and SQL Server, which range in the millions. This discrepancy can be attributed to the different deployment patterns and purposes of each database type. Couchbase is deliberately deployed for specific workloads, often by teams with expertise in its usage, leading to a more deliberate network design.

As a result, Couchbase's exposure count, while still significant, is smaller than the massive numbers observed for relational databases.