Critical severity · published Oct 20, 2026
CVE-2026-86471
Apache CouchDB: Admin credentials leading to code execution as operating system user
9.3
CVSS
0.6%
EPSS
No
On KEV
Description
An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin to run arbitrary shell commands as the CouchDB operating system user.
Users are recommended to upgrade to version 3.5.3, which fixes this issue.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
Apache CouchDB · Apache Software Foundation
before 3.5.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-86471
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-86471
lists.apache.org
https://lists.apache.org/thread.html/pj83174r8f8f64odf47fwhozbfjtot0f
lists.apache.org
https://lists.apache.org/thread/c8p73gswgogtnzvk7hpw8jb8d4mnosdp
www.openwall.com
http://www.openwall.com/lists/oss-security/2026/10/20/11
More from Apache CouchDB
9.8
CVE-2022-24706
Remote Code Execution Vulnerability in Packaging
8.1
CVE-2026-90800
Apache CouchDB: Auth bypass in prefixed _users and _replicator databases
7.7
CVE-2026-90797
Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_session
7.2
CVE-2018-11769
CouchDB administrative users before 2.2.0 can configure the database server via HTTP(S)
6.0
CVE-2026-107755
Apache CouchDB: Credential Disclosure to Non-Owner Members via Object-Form Replication Endpoint URLs