CVE-2026-86471: Apache CouchDB: Admin credentials leading to code execution as operating system user
An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin to run arbitrary shell commands as the CouchDB operating system user.
Users are recommended to upgrade to version 3.5.3, which fixes this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
bitnami/couchdbto a version that resolves this vulnerability.Fixed in 3.5.3 - Upgrade
Upgrade
Apache CouchDBto a version that resolves this vulnerability.Fixed in 3.5.3
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs CouchDB server administrator credentials. The resulting commands run with the privileges of the CouchDB operating system user.
Which deployments are affected?
Apache CouchDB 3.5.2 and earlier are affected on all platforms. Version 3.5.3 fixes the issue.
What should be done if immediate remediation is needed?
Upgrade CouchDB to version 3.5.3. Until then, restrict and review access to CouchDB server administrator credentials, since those credentials are required for exploitation.