Loading vulnerability…
Authenticated OS Command Injection in Apache CouchDB
CVE-2026-86471 is an OS command injection vulnerability in Apache CouchDB 3.5.2 and earlier on all platforms. An unvalidated runtime configuration value allows an authenticated CouchDB server administrator to execute arbitrary shell commands with the privileges of the operating system account running CouchDB. The specific configuration setting and vulnerable function are not identified. Apache CouchDB 3.5.3 fixes the vulnerability.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation crosses the boundary between CouchDB server administration and operating system command execution. An attacker can compromise the confidentiality and integrity of data and resources accessible to the CouchDB service account and potentially disrupt services within that account's permissions. Execution as root or another more privileged operating system account is not established.
If you can’t patch tonight, do this now.
No specific temporary workaround is documented. Until upgrading, restrict CouchDB server administrator access to trusted personnel and limit the operating system permissions of the CouchDB service account. These precautions reduce exposure and potential impact but do not fix the vulnerability.
Patch, then assume compromise.
Upgrade Apache CouchDB to version 3.5.3, which fixes the vulnerability. For distribution packages without a vendor-supplied fix, migrate to a supported package or deployment containing the upstream fix.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.