---
id: "CVE-2022-24706"
kind: "vulnerability"
aliases: ["CVE-2022-24706"]
title: "In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without\u2026"
severity: "critical"
cvss: 10.0
epss: 0.9251
exploited: true
status: "open"
category: "package"
products: [{"name": "apache couchdb", "fixed": ["3.2.2"], "affected": "< 3.2.2", "ecosystem": "vendor"}, {"name": "Apache CouchDB", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["couchdb", "exploited", "package", "self-hosted"]
not_affected_if: ["unknown"]
published_at: "2022-04-26T10:15:35+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-24T00:09:51+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-24706", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-24706", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24706", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without…

Apache CouchDB ships with an insecure default initialization that lets an attacker escalate to administrator privileges. CISA lists it as actively exploited in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:apache couchdb affected < 3.2.2 fixed 3.2.2
- vendor:Apache CouchDB affected ? fixed ?

## Fix

Apply the vendor update per Apache CouchDB instructions; the fixed version is unknown from the sources. Verify the admin credentials and the admin-party setting in local.ini are not left at defaults.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-24706
- 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2022-24706
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2022-24706

## From the sources

In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_