CVE-2026-86471

Deferred Deferred - Pending Action

Command Injection in Apache CouchDB

Publication date: 2026-10-20

Last updated on: 2026-10-21

Assigner: Apache Software Foundation

Description

An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin to run arbitrary shell commands as the CouchDB operating system user. Users are recommended to upgrade to version 3.5.3, which fixes this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-21

Generated

2026-11-09

AI Q&A

2026-10-20

EPSS Evaluated

2026-11-08

NVD

CVE-2026-86471

EUVD

EUVD-2026-105155

Affected Vendors & Products

Vendor	Product	Version / Range
Apache Software Foundation	Apache CouchDB	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability in Apache CouchDB 3.5.2 and below involves an unvalidated runtime configuration value that allows a server admin to execute arbitrary shell commands as the CouchDB operating system user. This means an attacker with admin access could run unauthorized commands on the server.

Detection Guidance

Check the installed version of Apache CouchDB using commands like 'couchdb --version' or 'dpkg -l | grep couchdb' on Debian-based systems. If the version is 3.5.2 or below, the system is vulnerable.

Impact Analysis

If exploited, this vulnerability could allow attackers to gain control over the CouchDB server, leading to data breaches, unauthorized access to sensitive information, or disruption of services. Systems running vulnerable versions are at risk if admin credentials are compromised.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by enabling unauthorized access to personal or health data. Organizations may face legal penalties, reputational damage, and loss of trust due to data breaches resulting from this issue.

Mitigation Strategies

Upgrade Apache CouchDB to version 3.5.3 or later immediately. Follow the official Apache CouchDB upgrade instructions for your platform to ensure proper installation and configuration.

Hi! I’m here to help you understand CVE-2026-86471. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...