CVE-2017-12636
HighSummary
CouchDB administrative users can configure the database server via HTTP(S), allowing them to specify paths for operating system-level binaries. This enables the CouchDB user to execute arbitrary shell commands, including downloading and executing scripts from the public internet.
Risk Assessment
The risk associated with this vulnerability is the potential for administrative users to execute malicious code, which could lead to system compromise and data leakage.
Recommendation
It is recommended to upgrade Apache CouchDB to version 1.7.0 or 2.1.1 and above to mitigate this vulnerability. Additionally, access to administrative accounts should be restricted and user activities monitored.
Other vulnerabilities in Apache CouchDB
See all- CVE-2026-90800High
Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the full contents of a prefixed _user or _replicator database via an unauthorised API endpoint. The use of prefixed system databases is very rare. Users are recommended to upgrade to version 3.5.3, which fixes this issue.
- CVE-2026-90799Low
Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to cause a denial of service via memory exhaustion. Users are recommended to upgrade to version 3.5.3, which fixes this issue.
- CVE-2026-90798Low
A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a replication source or target to cause a denial of service via creating an infinite HTTP redirect loop. Users are recommended to upgrade to version 3.5.3, which fixes this issue.
- CVE-2026-90797High
Apache CouchDB 3.5.2 and below contains an unlimited gzip decompression routine in chttpd. Any remote client can cause a denial of service via memory exhaustion.
- CVE-2026-107755Medium
Apache CouchDB 3.5.2 and below insufficiently filters credentials in the _replicator database. An authenticated user can read replication credentials of other users' replications, not just their own.
- CVE-2026-86471Critical
An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin to run arbitrary shell commands as the CouchDB operating system user.
- CVE-2022-24706CriticalActively exploited
In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The documentation has always recommended proper security measures, including a firewall.
- CVE-2017-12635Critical
In Apache CouchDB before version 1.7.0 and 2.x before version 2.1.1, a vulnerability allows submitting _users documents with duplicate 'roles' keys, which can lead to non-admin users being granted admin privileges.
Original NVD description (English source)
CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include paths for operating system-level binaries that are subsequently launched by CouchDB. This allows an admin user in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to execute arbitrary shell commands as the CouchDB user, including downloading and executing scripts from the public internet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS