An issue exists in Couchbase Server prior to 7.2.4. cURL calls to /diag/eval are not sufficiently restricted.