Apache CouchDB CVE-2026-86471

Requires an authenticated CouchDB *server administrator* account (PR:H) that can set runtime configuration values; the attacker abuses an unvalidated configuration parameter so that its value is interpreted as a shell command executed as the CouchDB OS user. Limiting factors: exploitation is impossible without admin-level credentials/role, so the primary risk is privilege escalation from CouchDB admin to the host OS, or an insider/post-credential-theft scenario; it is NOT remote-unauthenticated. Affected: Apache CouchDB 3.5.2 and earlier on all platforms; upgrading to 3.5.3 removes the condition.

The provided CVSS 4.0 score of 9.3 (Critical) is driven by network attack vector (AV:N), low complexity (AC:L), and high vulnerable+subsequent system impact (VC:H/VI:H/SC:H/SI:H), reflecting that the flaw crosses a trust boundary from the CouchDB application into OS-level command execution. However, the single most important moderating signal is PR:H: exploitation requires an authenticated CouchDB *server admin*, so this is fundamentally a privilege-boundary escalation (database admin → arbitrary shell as the CouchDB OS user), not a remote-unauthenticated takeover. The CVSS 4.0 threat metric in the input is set to E:A ('Attacked'), which would normally imply exploit maturity, but NO CISA KEV status and NO EPSS probability were supplied in the input data, so active exploitation CANNOT be confirmed - treat the E:A value as unverified and potentially conflicting with the absence of KEV/POC evidence. Net real-world priority is moderate-to-high for environments where untrusted or multiple parties hold admin roles, or as a post-compromise escalation primitive, but lower where the CouchDB admin role is already fully trusted and tightly controlled. Patch promptly, but PR:H means this is not a wormable internet-wide emergency on its own.

An attacker who holds (or has stolen) CouchDB server admin credentials writes a crafted, unvalidated value into a runtime configuration parameter; when CouchDB consumes that value it executes attacker-supplied shell commands as the CouchDB OS user, escaping the database into OS-level code execution. No public exploit was identified in the provided data, and exploitation is gated behind authenticated administrative access (PR:H).