Skip to main content
Threat Radar animated logo

CVE-2026-86471: Vulnerability in Apache Software Foundation Apache CouchDB

0
Critical
VulnerabilityCVE-2026-86471cvecve-2026-86471gcveosvghsa-885r-pfpm-ch95ghsa
Published: 10/20/2026 (10/20/2026, 18:31:46 UTC)
Source: CVE Database V5
Vendor/Project: Apache Software Foundation
Product: Apache CouchDB

Description

An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin to run arbitrary shell commands as the CouchDB operating system user. Users are recommended to upgrade to version 3.5.3, which fixes this issue.

CVSS v4.0

Score 9.3critical

Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
High
User Interaction
None
Vuln. Confidentiality
High
Vuln. Integrity
High
Vuln. Availability
Low
Subsq. Confidentiality
High
Subsq. Integrity
High
Subsq. Availability
Low
Scope
N
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:A/S:N/AU:Y/R:U/V:C/RE:M/U:Red

Affected software

Apache Software Foundation

Apache CouchDB

Affected versions
>=0 <3.5.3
Mavenmore threats →ai
org.apache.couchdb/couchdb
pkg:maven/org.apache.couchdb/couchdb
Affected versions
>=0 <3.5.3

Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.

AI-Powered Analysis

Machine-generated threat intelligence

AILast updated: 10/20/2026, 16:03:22 UTC

Technical Analysis

An unvalidated runtime configuration value in Apache CouchDB versions 0 through 3.5.2 permits a CouchDB server administrator to run arbitrary shell commands with the privileges of the CouchDB operating system user. This vulnerability is present on all platforms supported by CouchDB. The flaw is addressed in version 3.5.3, which should be applied to remediate the issue.

Potential Impact

Successful exploitation allows a CouchDB server administrator to execute arbitrary shell commands on the host operating system with the privileges of the CouchDB user. This can lead to significant system compromise depending on the privileges of that user. The CVSS 4.0 score is 9.3 (critical), reflecting the high impact and ease of exploitation with no user interaction required.

Mitigation Recommendations

Users should upgrade Apache CouchDB to version 3.5.3 or later, which contains the official fix for this vulnerability. No other mitigations are specified or recommended by the vendor advisory.

Pro Console: star threats, build custom feeds, automate alerts via Slack, email & webhooks.Upgrade to Pro

Technical Details

Data Version
5.2
Assigner Short Name
apache
Date Reserved
2026-09-07T14:53:35.843Z
Cvss Version
4.0
State
PUBLISHED

Threat ID: 6ad78d892cdf04f6563d770b

Added to database: 10/20/2026, 15:49:29 UTC

Last enriched: 10/20/2026, 16:03:22 UTC

Last updated: 10/20/2026, 22:33:01 UTC

Views: 8

Community Reviews

0 reviews

Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.

Sort by
Loading community insights…

Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.

Actions

PRO

Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.

Please log in to the Console to use AI analysis features.

Need more coverage?

Upgrade to Pro Console for AI refresh and higher limits.

For incident response and remediation, OffSeq services can help resolve threats faster.

Latest Threats

Breach by OffSeqOFFSEQFRIENDS — 25% OFF

Check if your credentials are on the dark web

Instant breach scanning across billions of leaked records. Free tier available.

Scan now
OffSeq TrainingCredly Certified

Lead Pen Test Professional

Technical5-day eLearningPECB Accredited
View courses