.. Licensed under the Apache License, Version 2.0 (the "License"); you may not
.. use this file except in compliance with the License. You may obtain a copy of
.. the License at
..
..   http://www.apache.org/licenses/LICENSE-2.0
..
.. Unless required by applicable law or agreed to in writing, software
.. distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
.. WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
.. License for the specific language governing permissions and limitations under
.. the License.

.. _cve/2026-86471:

====================================================================================
CVE-2026-86471: Admin credentials leading to code execution as operating system user
====================================================================================

:Date: 12.10.2026

:Affected: 3.5.2 and below

:Severity: High

:Vendor: The Apache Software Foundation

Description
===========

CouchDB’s ``weatherreport`` diagnostics module used unsanitised configuration
values to construct shell commands. This allows CouchDB server admins that can
change config values at runtime using the ``/_config`` HTTP API to have CouchDB
execute arbitrary shell commands as the operating system user that CouchDB run
on.

Mitigation
==========

CouchDB no longer constructs shell commands from unsanitised configuration
values and avoids using shell commands where possible to achieve the same
functionality.

Workarounds
===========

N/A

Credit
======

The reporter of this issue has asked to remain anonymous.