CVE-2026-86471 Apache CouchDB: Admin credentials leading to code execution as operating system user

CriticalCVSS 9.3 EPSS 0.61%

Published: 2026-10-20 18:38
Updated: 2026-10-21 07:18
Exploit status: No public exploit known

Description

An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin to run arbitrary shell commands as the CouchDB operating system user.

Users are recommended to upgrade to version 3.5.3, which fixes this issue.

Affected products

Product	Affected versions	Fixed in
Apache CouchDB	< 3.5.3	3.5.3

References

lists.apache.org release-notes
lists.apache.org vendor-advisory
www.openwall.com

CVSS v4.0

9.3 Critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:A/S:N/AU:Y/R:U/V:C/RE:M/U:Red

Attack Vector: Network
Attack Complexity: Low
Attack Requirements: None
Privileges Required: High
User Interaction: None
Vulnerable System Confidentiality: High
Vulnerable System Integrity: High
Vulnerable System Availability: Low
Subsequent System Confidentiality: High
Subsequent System Integrity: High
Subsequent System Availability: Low
Exploit Maturity: Attacked
S: N
AU: Y
R: U
V: C
RE: M
U: Red

All scores (2)

v4.0 9.3 · apache
v4.0 9.3 · security@apache.org

Weakness & likelihood

EPSS (exploitation probability, 30 days): 0.61% (percentile 49.5)
CWE: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.