Apache CouchDB Fixes Critical Admin-to-OS Command Execution Flaw and Five Other Vulnerabilities

Apache CouchDB 3.5.3 fixes six security vulnerabilities, including CVE-2026-86471, a critical OS command injection flaw with a reported CVSS 4.0 score of 9.3. Affecting versions before 3.5.3 on all platforms, the flaw allows an authenticated CouchDB server administrator to exploit an unvalidated runtime configuration value to execute arbitrary shell commands as the CouchDB operating system user. Exploitation is possible over the network without user interaction, but requires administrator privileges; it is not an unauthenticated remote takeover. The maintenance release was published on October 12, with security details initially withheld to give users time to upgrade.

The release also addresses CVE-2026-90800, an authorization bypass exposing the full contents of rarely used prefixed system databases; CVE-2026-90799, which lets authenticated users trigger atom-table and memory exhaustion through crafted changes-sequence values or search bookmarks; and CVE-2026-90798, which allows a replication source or target owner to cause denial of service through infinite HTTP redirects. Two additional fixes cover CVE-2026-90797 and CVE-2026-107755, for which the supplied release announcement provides no technical details. Available assessments recorded no known exploitation of CVE-2026-86471 or CVE-2026-90800. Organizations should promptly upgrade to CouchDB 3.5.3, using the available packages or Docker images, and restrict administrative access while deployment is pending.