CVE-2026-86471

An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin to run arbitrary shell commands as the CouchDB operating system user. Users are recommended to upgrade to version 3.5.3, which fixes this issue.

Score

CVSS 4.0 9.3 Critical

Status

Deferred - security@apache.org

Published

2026-10-20

Last modified

2026-10-21

Weaknesses

CWE-78

Affected products

• Apache Couchdb (Apache Software Foundation)

References

• https://lists.apache.org/thread.html/pj83174r8f8f64odf47fwhozbfjtot0f
• https://lists.apache.org/thread/c8p73gswgogtnzvk7hpw8jb8d4mnosdp
• http://www.openwall.com/lists/oss-security/2026/10/20/11