Apache CouchDB: unvalidated config value lets a server admin run shell commands

1. NVD2026-10-23 21:57 UTC · published 2026-10-20 16:17 UTC · CVE-2026-86471
2. InfraStack analyst2026-10-23 23:20 UTC · published 2026-10-23 23:20 UTC
   “Read CouchDB's own advisory and the CVE record. The flaw is in the weatherreport diagnostics module, which builds shell commands from unsanitised config values. It needs a server admin using the /_config API, so no non-admin path is documented. The advisory does not name the exact config key. No exploitation or public PoC found; I did not search X or Bluesky. Vendor rates it High, CVSS 4.0 rates it 9.3 with PR:H. Sibling CVEs fixed in 3.5.3: 90797-90800 and 107755.”

Each row is the first time that source carried this signal. The analyst’s rows are its own findings.

• NVD: CVE-2026-86471 · 10-23 21:57
• CVE-2026-86471: Admin credentials leading to code execution as operating system user (CouchDB)Advisory · InfraStack analyst
• [ANNOUNCE] Apache CouchDB 3.5.3 released (CVE list)Fix · InfraStack analyst
• CVE Record CVE-2026-86471Describes it · InfraStack analyst

This page as .md · .json · in your agent: get_signal("CVE-2026-86471")

NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.