2.18. CVE-2026-86471: Admin credentials leading to code execution as operating system user

Date:

12.10.2026

Affected:

3.5.2 and below

Severity:

High

Vendor:

The Apache Software Foundation

2.18.1. Description

CouchDB’s weatherreport diagnostics module used unsanitised configuration values to construct shell commands. This allows CouchDB server admins that can change config values at runtime using the /_config HTTP API to have CouchDB execute arbitrary shell commands as the operating system user that CouchDB run on.

2.18.2. Mitigation

CouchDB no longer constructs shell commands from unsanitised configuration values and avoids using shell commands where possible to achieve the same functionality.

2.18.3. Workarounds

N/A

2.18.4. Credit

The reporter of this issue has asked to remain anonymous.