Apache CouchDB: Admin credentials leading to code execution as operating system user

Published 17 d ago 2026-10-20 · modified 17 d ago 2026-10-21 · JSON

CVSS

9.3

v4.0 · CNA

CISA KEV

not known exploited

EPSS

0.6%

percentile 49%

Public exploits

none known

An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin to run arbitrary shell commands as the CouchDB operating system user.

Users are recommended to upgrade to version 3.5.3, which fixes this issue.

CISA SSVC assessment

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 18 d ago 2026-10-20

Exploit prediction (EPSS)

0.61% probability of exploitation in the next 30 days, higher than 49% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	4.0	9.3	`CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:A/S:N/AU:Y/R:U/V:C/RE:M/U:Red`
CNA	4.0	9.3	`CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:M/U:Red`

Affected products

Apache Software Foundation Apache CouchDB

Classification

Weakness

CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

lists.apache.org /thread.html/pj83174r8f8f64odf47fwhozbfjtot0f · release-notes
lists.apache.org /thread/c8p73gswgogtnzvk7hpw8jb8d4mnosdp · vendor-advisory
openwall.com /lists/oss-security/2026/10/20/11

Sources

CVE List: CVE-2026-86471
NVD: CVE-2026-86471

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary