Paper/Archive/CVE-2026-86471

CVE-2026-86471

Apache Software Foundation Apache CouchDB — Apache CouchDB: Admin credentials leading to code execution as operating system user

EPSS 0.6%CVSS 9.3

critical.is priorityof 100

CVSS 9.3 (CNA)9.3 / 10 × 3027.9 Not in CISA KEV+300.0 EPSS percentile 48.9.489 × 209.8 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin to run arbitrary shell commands as the CouchDB operating system user. Users are recommended to upgrade to version 3.5.3, which fixes this issue.

Affected

ProductAffectedFixed inSource

Apache CouchDB< 3.5.33.5.3CNA

Scores by source

apache (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:A/S:N/AU:Y/R:U/V:C/RE:M/U:Red

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

reflists.apache.org/thread.html/pj83174r8f8f64odf47fwhozbfjtot0f advisorylists.apache.org/thread/c8p73gswgogtnzvk7hpw8jb8d4mnosdp refopenwall.com/lists/oss-security/2026/10/20/11