CVE-2026-86471
An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms…
- Risk score
- 66/100
- CVSS
- 9.3 v4.0
- Exploit chance (30 days)
- 0.6%
- Published
- 20 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Apache CouchDB 3.5.2 and below has an unvalidated runtime configuration value, allowing a CouchDB server admin to run arbitrary shell commands as the CouchDB operating system user. An attacker could exploit this to gain elevated privileges.
- Affected
- {'products': ['Apache CouchDB'], 'packages': [], 'versions': ['3.5.2 and below']}
- Fix
- Upgrade to version 3.5.3
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.3 critical
References
Original description
An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin to run arbitrary shell commands as the CouchDB operating system user. Users are recommended to upgrade to version 3.5.3, which fixes this issue.
Last activity 20 Oct 2026. Patch Forecast updates every hour.