Apache CouchDB: OS command injection via unvalidated configuration value

Summary

Apache CouchDB 3.5.2 and earlier, on all platforms, do not validate a runtime configuration value. A CouchDB server admin can use this to run arbitrary shell commands as the operating system user that runs CouchDB. The attacker needs existing server-admin rights, so the realistic path is a leaked or reused admin credential.

Affected

• Apache CouchDB 3.5.2 and earlier (CVE record range: versions below 3.5.3), all operating systems

Fixed in

• Apache CouchDB 3.5.3 (requires Erlang/OTP 27 or newer)
• No fixed release known for 3.4.x or older branches; do not assume these are patched

Workaround

• No vendor workaround published; the only remedy in the sources is the upgrade to 3.5.3
• Interim measure (our assessment, not from a vendor source): restrict server-admin rights, rotate admin credentials and keep the CouchDB HTTP API off untrusted networks until the upgrade is done

Exploitation

• No evidence of active exploitation found
• CISA SSVC assessment: exploitation none, automatable no, technical impact total
• Not listed in CISA KEV; no public proof of concept found for this CVE
• The CVSS vector includes E:A (attacked), which conflicts with the SSVC data; do not rely on it without checking its source

Our recommendation

• Upgrade CouchDB to 3.5.3 or later; the same release fixes other CouchDB CVEs, including CVE-2026-90797 (pre-auth gzip bomb), which is more urgent for internet-facing installs
• Prioritise installs where admin credentials are shared, embedded in client apps or reachable from untrusted networks
• Rotate CouchDB admin credentials and review who holds server-admin rights
• Check whether CouchDB runs under a service account with access to other data and restrict that access
• Identify 3.4.x or older installations and plan a migration, as no fix is known for those branches

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Apache mailing list advisory thread lists.apache.org
• Apache mailing list thread lists.apache.org
• CouchDB 3.5.3 release notes blog.couchdb.org
• endoflife.date: Apache CouchDB endoflife.date
• Mallory: CVE-2026-86471 assessment mallory.ai
• Strix CVE record www.strix.ai
• StartOS packaging discussion github.com
• CouchDB mailing list post on 3.5.3 fixes www.mail-archive.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:05.