CRITICAL 9.3 NVD
CVE-2026-86471
An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin to run arbitrary shell commands as t
An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin to run arbitrary shell commands as the CouchDB operating system user.
Users are recommended to upgrade to version 3.5.3, which fixes this issue.
References
- https://lists.apache.org/thread.html/pj83174r8f8f64odf47fwhozbfjtot0f
- https://lists.apache.org/thread/c8p73gswgogtnzvk7hpw8jb8d4mnosdp
- https://www.openwall.com/lists/oss-security/2026/10/20/11
This critical severity vulnerability with a CVSS score of 9.3 was published on 2026-10-20 via NVD.
Risk Timeline
CVE Disclosed2026-10-20 · -1 days ago
Remediation Resources
Official Advisory
www.openwall.com/lists/oss-security/2026/10/20/11Analysis & PoC
lists.apache.org/thread/c8p73gswgogtnzvk7hpw8jb8d4mnosdp
vulnfeed aggregates 16920 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.