CVE-2026-86471

9.3Critical

Published 20 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash

9.3Critical

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: None
Impact: High impact on confidentiality, integrity
Weakness: CWE-78

Impact

Authenticated CouchDB server admins can execute arbitrary shell commands with the privileges of the CouchDB OS user. They need administrative credentials to CouchDB to exploit it.

Root cause

The server fails to validate a runtime configuration setting before using it.

Affected systems

Apache CouchDB 3.5.2 and below on all platforms

CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:M/U:Red

Fix & remediation

Upgrade to Apache CouchDB 3.5.3 or higher. No interim mitigation is provided, so restrict CouchDB admin credentials and network access to trusted operators until patched.

shell

$ sudo apt-get update && sudo apt-get install --only-upgrade couchdb

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin to run arbitrary shell commands as the CouchDB operating system user. Users are recommended to upgrade to version 3.5.3, which fixes this issue.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-86471