CouchDB before 3.5.3 lets admins run shell commands (CVE-2026-86471)
Original title: CVE-2026-86471: Apache CouchDB: Admin credentials leading to code execution as operating system user
A CouchDB server admin can execute arbitrary shell commands as the CouchDB OS user; upgrade to 3.5.3.
Jan Lehnardt reported CVE-2026-86471 in Apache CouchDB on October 20. An unvalidated runtime configuration value in version 3.5.2 and below, on all platforms, lets a CouchDB server admin run arbitrary shell commands as the CouchDB operating system user. CVSS 4.0 is 9.3 (critical) and requires high privileges. The fix is version 3.5.3.
Unconfirmed: The advisory vector marks exploit maturity Attacked, but the description does not describe specific attacks.
- The flaw needs CouchDB server admin credentials (PR:H).
- Commands run as the CouchDB operating system user.
- Affected versions are 3.5.2 and below on all platforms.
- The CVSS vector sets exploit maturity to Attacked (E:A).
Impact: Admin can run arbitrary shell commands as the CouchDB OS user
| Product | Affected | Fixed in |
|---|---|---|
| Apache CouchDB | 3.5.2 and below | 3.5.3 |
- 1.Upgrade Apache CouchDB to 3.5.3.
- CVEs
- CVE-2026-86471
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-86471 | OS command injection in Apache CouchDB admin config | 9.3 | — |
From the original article
Posted by Jan Lehnardt on Oct 20 Severity: CVSS 4. 0: 9. 3 (critical) CVSS:4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.