{"id":"CVE-2026-86471","kind":"vulnerability","aliases":["CVE-2026-86471"],"related":[],"title":"Apache CouchDB: unvalidated config value lets a server admin run shell commands","description":"An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin to run arbitrary shell commands as the CouchDB operating system user.\n\nUsers are recommended to upgrade to version 3.5.3, which fixes this issue.","summary":"Apache CouchDB 3.5.2 and below: the weatherreport diagnostics module builds shell commands from unsanitised runtime config values. A CouchDB server admin who can change config through the /_config HTTP API can run arbitrary shell commands as the OS user CouchDB runs as. It needs admin credentials. Fixed in 3.5.3.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"couchdb","fixed":["3.5.3"],"affected":"<= 3.5.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["command-injection","couchdb","package","rce","self-hosted"],"not_affected_if":["auth-required","managed-hosting"],"how_to_check":"Run curl -s http://HOST:5984/ and read the version field. Anything at or below 3.5.2 is affected. Also check who holds server admin credentials, and whether /_config is reachable from untrusted networks.","fix":"Upgrade to Apache CouchDB 3.5.3 or later. The vendor lists no workaround. Until you upgrade, limit server admin access, keep the node port off untrusted networks, and rotate admin credentials if they may have leaked.","status":"open","published_at":"2026-10-20T16:17:15+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-23T22:39:27+00:00","updated_at":"2026-10-23T23:20:40+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-23T22:39:27Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Apache CouchDB to 3.5.3 or later.","reach":"network","title":"Apache CouchDB: unvalidated config value lets a server admin run shell commands","impact":"high","summary":"Apache CouchDB 3.5.2 and below does not validate a runtime configuration value, so a CouchDB server admin can run arbitrary shell commands. The commands run as the operating system user that runs CouchDB.","category":"package","who_cares":["couchdb","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Admin gains shell commands as the CouchDB operating system user.","analyst_note":"Confirm the exact configuration key involved and whether the flaw is reachable by any non-admin user; check the Apache CouchDB 3.5.3 release notes.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["auth-required"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00047,"input_tokens":2929,"output_tokens":355,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the exact configuration key involved and whether the flaw is reachable by any non-admin user; check the Apache CouchDB 3.5.3 release notes.","search":"'-2026':14A,17A '-86471':15A,18A '/_config':56B '3.5.2':31B,86C '3.5.3':77B,115C 'admin':9A,49B,73B,96C 'allow':92C 'apach':1A,29B,84C 'api':58B 'arbitrari':61B,99C 'build':38B 'chang':52B 'command':12A,21B,40B,63B,101C 'command-inject':20B 'config':4A,44B,53B 'configur':81C 'couchdb':2A,19A,23B,30B,47B,68B,85C,94C,104C 'credenti':74B 'cve':13A,16A 'diagnost':36B 'fix':75B,117C 'host':28B 'http':57B 'inject':22B 'issu':119C 'let':6A 'modul':37B 'need':72B 'oper':105C 'os':66B 'packag':24B 'platform':91C 'rce':25B 'recommend':110C 'run':10A,60B,69B,98C 'runtim':43B,80C 'self':27B 'self-host':26B 'server':8A,48B,95C 'shell':11A,39B,62B,100C 'system':106C 'unsanitis':42B 'unvalid':3A,79C 'upgrad':112C 'user':67B,107C,108C 'valu':5A,45B,82C 'version':114C 'weatherreport':35B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T16:17:15+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:M/U:Red","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86471","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86471","severity":null,"published_at":"2026-10-20T16:17:15+00:00","modified_at":"2026-10-21T04:18:11+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-86471:417","url":null,"severity":null,"published_at":"2026-10-23T23:20:40+00:00","modified_at":"2026-10-23T23:20:40+00:00","first_seen_at":"2026-10-23T23:20:40+00:00","fetched_at":"2026-10-23T23:20:40+00:00","note":"Read CouchDB's own advisory and the CVE record. The flaw is in the weatherreport diagnostics module, which builds shell commands from unsanitised config values. It needs a server admin using the /_config API, so no non-admin path is documented. The advisory does not name the exact config key. No exploitation or public PoC found; I did not search X or Bluesky. Vendor rates it High, CVSS 4.0 rates it 9.3 with PR:H. Sibling CVEs fixed in 3.5.3: 90797-90800 and 107755."}],"documents":[{"id":1899,"url":"https://docs.couchdb.org/en/stable/cve/2026-86471.html","title":"CVE-2026-86471: Admin credentials leading to code execution as operating system user (CouchDB)","kind":"advisory","source":"analyst","text":"Date 12.10.2026. Affected: 3.5.2 and below. Severity: High (vendor). CouchDB's weatherreport diagnostics module used unsanitised configuration values to construct shell commands. Server admins who can change config at runtime via the /_config HTTP API can make CouchDB execute arbitrary shell commands as the OS user CouchDB runs as. Mitigation: CouchDB no longer constructs shell commands from unsanitised config values. Workarounds: N/A.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1900,"url":"https://lists.apache.org/thread/y9l55z5w8z8g0ntts772ss6gmx3nyl33","title":"[ANNOUNCE] Apache CouchDB 3.5.3 released (CVE list)","kind":"release","source":"analyst","text":"CVE information for 3.5.3 now public: CVE-2026-86471, CVE-2026-90797, -90798, -90799, -90800, CVE-2026-107755.","published_at":null,"relation":"fix","confidence":null,"note":null},{"id":1901,"url":"https://www.cve.org/CVERecord?id=CVE-2026-86471","title":"CVE Record CVE-2026-86471","kind":"other","source":"analyst","text":"Unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a server admin to run arbitrary shell commands as the CouchDB OS user. Upgrade to 3.5.3. CVSS 4.0 9.3 Critical, PR:H. Affected from 0 before 3.5.3.","published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}