---
id: "CVE-2026-86471"
kind: "vulnerability"
aliases: ["CVE-2026-86471"]
title: "Apache CouchDB: unvalidated config value lets a server admin run shell commands"
severity: "critical"
cvss: 9.3
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "couchdb", "fixed": ["3.5.3"], "affected": "<= 3.5.2", "ecosystem": "vendor"}]
ecosystems: []
tags: ["command-injection", "couchdb", "package", "rce", "self-hosted"]
not_affected_if: ["auth-required", "managed-hosting"]
published_at: "2026-10-20T16:17:15+00:00"
first_seen_at: "2026-10-23T21:57:20+00:00"
updated_at: "2026-10-23T23:20:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86471", "first_seen_at": "2026-10-23T21:57:20+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:20:40+00:00"}]
---

# Apache CouchDB: unvalidated config value lets a server admin run shell commands

Apache CouchDB 3.5.2 and below: the weatherreport diagnostics module builds shell commands from unsanitised runtime config values. A CouchDB server admin who can change config through the /_config HTTP API can run arbitrary shell commands as the OS user CouchDB runs as. It needs admin credentials. Fixed in 3.5.3.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:couchdb affected <= 3.5.2 fixed 3.5.3

## How to check

Run curl -s http://HOST:5984/ and read the version field. Anything at or below 3.5.2 is affected. Also check who holds server admin credentials, and whether /_config is reachable from untrusted networks.

## Fix

Upgrade to Apache CouchDB 3.5.3 or later. The vendor lists no workaround. Until you upgrade, limit server admin access, keep the node port off untrusted networks, and rotate admin credentials if they may have leaked.

## Timeline

- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-86471
- 2026-10-23T23:20:40+00:00 analyst — Read CouchDB's own advisory and the CVE record. The flaw is in the weatherreport diagnostics module, which builds shell commands from unsanitised config values. It needs a server admin using the /_config API, so no non-admin path is documented. The advisory does not name the exact config key. No exploitation or public PoC found; I did not search X or Bluesky. Vendor rates it High, CVSS 4.0 rates it 9.3 with PR:H. Sibling CVEs fixed in 3.5.3: 90797-90800 and 107755.

## Documents

- [advisory] CVE-2026-86471: Admin credentials leading to code execution as operating system user (CouchDB) https://docs.couchdb.org/en/stable/cve/2026-86471.html
- [describes] CVE Record CVE-2026-86471 https://www.cve.org/CVERecord?id=CVE-2026-86471
- [fix] [ANNOUNCE] Apache CouchDB 3.5.3 released (CVE list) https://lists.apache.org/thread/y9l55z5w8z8g0ntts772ss6gmx3nyl33

## From the sources

An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin to run arbitrary shell commands as the CouchDB operating system user.

Users are recommended to upgrade to version 3.5.3, which fixes this issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_