UBUNTU-CVE-2026-86471

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2026-86471

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-86471.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-86471

Upstream

CVE-2026-86471

Published

2026-10-20T16:17:00Z

Modified

2026-10-28T20:17:24Z

Severity

9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:A/S:N/AU:Y/R:U/V:C/RE:M/U:Red CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin to run arbitrary shell commands as the CouchDB operating system user. Users are recommended to upgrade to version 3.5.3, which fixes this issue.

References

Affected packages

Ubuntu:16.04:LTS / couchdb

Package

Name: couchdb
Purl: pkg:deb/ubuntu/couchdb?arch=source&distro=xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.6.0-0ubuntu7

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "couchdb",
            "binary_version": "1.6.0-0ubuntu7"
        },
        {
            "binary_name": "couchdb-bin",
            "binary_version": "1.6.0-0ubuntu7"
        },
        {
            "binary_name": "couchdb-common",
            "binary_version": "1.6.0-0ubuntu7"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-86471.json"