CVE-2026-86471
Last modified
CVE-2026-86471 is a critical-severity vulnerability rated 9.3/10 on the CVSS scale. An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin to run arbitrary shell commands as the CouchDB operating system user. Users are recommended to upgrade to version 3.5.3, which fixes this issue..
Description
An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin to run arbitrary shell commands as the CouchDB operating system user. Users are recommended to upgrade to version 3.5.3, which fixes this issue.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache CouchDB | < 3.5.3 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-86471?
How severe is CVE-2026-86471?
How do I fix CVE-2026-86471?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-86464In the current development version of Eclipse aeriOS, for wh…9.9
- CVE-2026-86465Apache Airflow Akeyless provider: the Akeyless secrets backe…6.5
- CVE-2026-86466Apache Airflow FAB provider: the Authentik OAuth path in the…8.1
- CVE-2026-86467Apache Airflow Amazon provider: the AWS auth manager's SAML …
- CVE-2026-86469A flaw was found in GLib2. When g_file_replace() is used wit…5.3
- CVE-2026-8647Crypt::ScryptKDF versions through 0.010 for Perl uses insecu…4.8
- CVE-2026-86472fast-uri is a dependency-free RFC 3986 URI parser for Node.j…4.8
- CVE-2026-86473Apache Airflow: the Core API logout endpoint revokes only a …9.1
- CVE-2026-86474The lack of TLS certificate validation when downloading firm…7.7
- CVE-2026-86475The Appointment Hour Booking WordPress plugin before 1.5.95 …5.3
- CVE-2026-86476A flaw was found in gst-plugins-base. A heap buffer overflow…8.4
- CVE-2026-86477Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
Are you affected by CVE-2026-86471?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST