Input validation error in Apache CouchDB - CVE-2026-86471
Published: October 23, 2026
Vulnerability identifier: #VU157388
CSH Severity: Low
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-86471
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to execute arbitrary shell commands as the CouchDB operating system user.
The vulnerability exists due to improper input validation in Apache CouchDB's runtime configuration handling when processing configuration values. A remote privileged user can supply a malicious runtime configuration value to execute arbitrary shell commands as the CouchDB operating system user.
Affected software
Apache CouchDB
How to mitigate CVE-2026-86471
Install security update from vendor's website.
Apache CouchDB - update to 3.5.3